[comp.sys.amiga.tech] New virus?

jac423@leah.albany.edu (Jules Cisek) (11/27/90)

I recently tried running BallyIII off of one of my  game disks but got
a disk validation error after inserting it.  Diskdoctor found track 40
to be corrupt but was able to recover everything.  Then I noticed that
the name  of the  disk    was changed  to  "Lazarus"  (it used  to  be
"MoreGames").  No one else uses  my computer and I  know of no program
that would change the  name of a disk to  that.   Could this be  a new
virus?  The fact that only track 40 was  corrupt (smack in the middle)
only adds to   my suspicion.   By the  way,  VirusX  4.0 noted nothing
strange (I always run it since I got hit by Lamer II last summer).

-- 
|    // .______. J.Cisek  CSC MiniSystems  "i don't want the world,   \_o_/ |
|  \X/--|UU UUU| jac423@leah.albany.edu     i just want your half..." \\|   |
| AMIGA |______| Amiga Student On Campus Consultant  SUNY@Albany, USA  \\   |

jac423@leah.albany.edu (Julius Andrew Cisek) (11/27/90)

Thanks two the two users who responded EXTREMELY quickly.

Apparently, DiskDoctor will rename the disk to "Lazarus" if it doesn't
find a name for it.  Simple enough.   I guess I  can continue trusting
my VirusX... :)
-- 
|    // .______. J.Cisek  CSC MiniSystems  "i don't want the world,   \_o_/ |
|  \X/--|UU UUU| jac423@leah.albany.edu     i just want your half..." \\|   |
| AMIGA |______| Amiga Student On Campus Consultant  SUNY@Albany, USA  \\   |

jld8755@helios.TAMU.EDU (Jonathan Davis) (11/27/90)

jac423@leah.albany.edu (Jules Cisek) writes:

>I recently tried running BallyIII off of one of my  game disks but got
>a disk validation error after inserting it.  Diskdoctor found track 40
>to be corrupt but was able to recover everything.  Then I noticed that
>the name  of the  disk    was changed  to  "Lazarus"  (it used  to  be
>"MoreGames").  No one else uses  my computer and I  know of no program
>that would change the  name of a disk to  that.   Could this be  a new
>virus?  The fact that only track 40 was  corrupt (smack in the middle)
>only adds to   my suspicion.   By the  way,  VirusX  4.0 noted nothing
>strange (I always run it since I got hit by Lamer II last summer).

  It's not a new virus; Diskdoctor changes the name of the destination disk
to 'Lazarus' when it cannot determine the name of the disk you were
attempting to recover.

>-- 
>|    // .______. J.Cisek  CSC MiniSystems  "i don't want the world,   \_o_/ |
>|  \X/--|UU UUU| jac423@leah.albany.edu     i just want your half..." \\|   |
>| AMIGA |______| Amiga Student On Campus Consultant  SUNY@Albany, USA  \\   |

**
|AMIGA ///                                                                  | 
|-----///    Jonathan Davis               "Dyslexics of the world, untie!"  | 
| \\\///     jld8755@helios.tamu.edu          --Unknown.                    |
|  \XX/                                                                     |

jms@vanth.UUCP (Jim Shaffer) (11/28/90)

In article <1990Nov26.215421.16919@sarah.albany.edu> jac423@leah.albany.edu (Jules Cisek) writes:
>
>I recently tried running BallyIII off of one of my  game disks but got
>a disk validation error after inserting it.  Diskdoctor found track 40
>to be corrupt but was able to recover everything.  Then I noticed that
>the name  of the  disk    was changed	to  "Lazarus"  (it used  to  be
>"MoreGames").  No one else uses  my computer and I  know of no program

DiskDoctor changes disk names to Lazarus under certain circumstances.  I
don't know what those circumstances are, because I never use DiskDoctor.  I
prefer FixDisk personally, and there's another one called DiskSalve that a
lot of people seem to like.  But just about everyone will probably tell you
that anything is better than DiskDoctor.

		     "When I was driving once I saw this painted on a bridge:"

>|    // .______. J.Cisek  CSC MiniSystems  "i don't want the world,   \_o_/ |
>|  \X/--|UU UUU| jac423@leah.albany.edu     i just want your half..." \\|   |
>| AMIGA |______| Amiga Student On Campus Consultant  SUNY@Albany, USA	\\   |

--
paper :  James Shaffer Jr., 37 Brook Street, Montgomery, PA  17752
uucp  :  uunet!cbmvax!amix!vanth!jms  (or)  rutgers!cbmvax!amix!vanth!jms
domain:  jms%vanth@amix.commodore.com	    CompuServe: 72750,2335
quote :  ATTENTION ALL PLANETS OF THE SOLAR FEDERATION: WE HAVE ASSUMED CONTROL

skank@iastate.edu (Skank George L) (12/02/90)

	Two things, could someone tell me what the highest legitimate
version of VirusX is (is it in fact 4.0?), and could someone please tell
me if it runs OK under 2.0?

                                Thanks,
                                        George

twells@eecs.cs.pdx.edu (Dark Tangent) (12/03/90)

skank@iastate.edu (Skank George L) writes:


>	Two things, could someone tell me what the highest legitimate
>version of VirusX is (is it in fact 4.0?), and could someone please tell
>me if it runs OK under 2.0?

>                                Thanks,
>                                        George
The current version of VirusX is 4.01. This was a minor fix over 4.0 so that

it would run correctly under 2.0.
	Tabor Wells

|------------------------------------| "Life. You're born. You live. You  |
|	Tabor Wells		     |   go on some diets. You die.       |
|	twells@eecs.cs.pdx.edu	     |	        			  |
|------------------------------------|		-Bloom County		  |			  |

joseph@valnet.UUCP (Joseph P. Hillenburg) (12/04/90)

skank@iastate.edu (Skank George L) writes:

> 
> 	Two things, could someone tell me what the highest legitimate
> version of VirusX is (is it in fact 4.0?), and could someone please tell
> me if it runs OK under 2.0?

Latest legitimate version is 4.01. Works fine under 2.0. VX 4.00 breaks.
> 
>                                 Thanks,
>                                         George


                        Joseph Hillenburg
             Secretary, Bloomington Amiga Users Group
joseph@valnet.UUCP                        ...!iuvax!valnet!joseph
  "Only Apple could slow down a 68030 chip." -Computer Shopper

burton@latcs1.oz.au (J Anteloupas D. Bronzo.) (12/04/90)

Followup-To: 
Distribution: 
Organization: B.E.A.R. Group Incorporated,Latrobe Univ.,Melb,Australia
Keywords: 

In <1990Nov26.215421.16919@sarah.albany.edu>,
	I could have sworn jac423@leah.albany.edu (Jules Cisek) managed to say:
>
>
>I recently tried running BallyIII off of one of my  game disks but got
>a disk validation error after inserting it.  Diskdoctor found track 40
>to be corrupt but was able to recover everything.  Then I noticed that
>the name  of the  disk    was changed  to  "Lazarus"  (it used  to  be
					    ^^^^^^^^^^




	I found this beastie a few months ago. I was running VirusX4.0
which didn't find it, and zerovirus V?.?? couldn't see it either
	so I killed it by reformatting all of my working floppies.
I've had no problems since.

>"MoreGames").  No one else uses  my computer and I  know of no program
>that would change the  name of a disk to  that.   Could this be  a new
>virus?  The fact that only track 40 was  corrupt (smack in the middle)
>only adds to   my suspicion.   By the  way,  VirusX  4.0 noted nothing
>strange (I always run it since I got hit by Lamer II last summer).
>
>-- 
>|    // .______. J.Cisek  CSC MiniSystems  "i don't want the world,   \_o_/ |
>|  \X/--|UU UUU| jac423@leah.albany.edu     i just want your half..." \\|   |
>| AMIGA |______| Amiga Student On Campus Consultant  SUNY@Albany, USA  \\   |


		James who has just realised his 'Organisation' is out of date.

lphillips@lpami.wimsey.bc.ca (Larry Phillips) (12/05/90)

In <9300@latcs1.oz.au>, burton@latcs1.oz.au (J Anteloupas D. Bronzo.) writes:
>Followup-To: 
>Distribution: 
>Organization: B.E.A.R. Group Incorporated,Latrobe Univ.,Melb,Australia
>Keywords: 
>
>In <1990Nov26.215421.16919@sarah.albany.edu>,
>	I could have sworn jac423@leah.albany.edu (Jules Cisek) managed to say:
>>
>>
>>I recently tried running BallyIII off of one of my  game disks but got
>>a disk validation error after inserting it.  Diskdoctor found track 40
>>to be corrupt but was able to recover everything.  Then I noticed that
>>the name  of the  disk    was changed  to  "Lazarus"  (it used  to  be
>					    ^^^^^^^^^^
>	I found this beastie a few months ago. I was running VirusX4.0
>which didn't find it, and zerovirus V?.?? couldn't see it either
>	so I killed it by reformatting all of my working floppies.
>I've had no problems since.

Great going James. You've resurrected a disk with DiskDoctor, and then proceeded
to kill it by formatting it. That'll teach it!


--
The only things to survive a nuclear war will be cockroaches and IBM PCs.
+-----------------------------------------------------------------------+ 
|   //   Larry Phillips                                                 |
| \X/    lphillips@lpami.wimsey.bc.ca -or- uunet!van-bc!lpami!lphillips |
|        COMPUSERVE: 76703,4322  -or-  76703.4322@compuserve.com        |
+-----------------------------------------------------------------------+