ahegde@mipos2.intel.com (09/20/90)
Hello there, i have a public domain `vi` editor for PC and it gives the following logo when invoked : ------------------- by Jim Goodnow II version 1.2 7/11/85 (c) 1984, 85 Manx Software Systems, Inc. -------------------- There is a peculiar problem with this program. Its original size should be around 25-30K (it is a .exe file). Every time this program is invoked, ITS SIZE INCREASES BY exactly 1808 bytes. For eg. if this file has 38080 bytes now, after i finish editing a file, this vi.exe would have 39808 bytes, and so on. I tried setting read only attribute on this file, but still the problem persists. However, i copied it to a floppy and write protected the floppy and only then its size remained constant. I have never had such an experience with any program and as i know dos quite well, this really puzzles me. I am sure more people would have had similar experiences with this or other program/s and there may be many who already found an answer to its strange behavior. Could someone please demistify this for me ? ( i have a vague suspecion that there may be a virus infection with this program) Thanks 9/20/90 Anoop Hegde ahegde@mipos2.intel.com or ahegde@mipos2.intel.com@uunet.uu.net (ps. as i donot monitor this news group frequently, please send all your mails to the above address)
jzl@micasa.UUCP (Jack Z. Lupic) (10/02/90)
ahegde@mipos2.intel.com writes: > > Hello there, > i have a public domain `vi` editor for PC and it > gives the following logo when invoked : > > ------------------- > by Jim Goodnow II > version 1.2 > 7/11/85 > > (c) 1984, 85 Manx Software Systems, Inc. > -------------------- > > There is a peculiar problem with this program. Its original size > should be around 25-30K (it is a .exe file). Every time this > program is invoked, ITS SIZE INCREASES BY exactly 1808 bytes. Maybe it's has a virus in it.Try scanning it with SCAN.EXE from McAfee and let us know what it tells you. Jack Lupic
terry@julia.math.ucla.edu (Terence J. McKiernan) (10/03/90)
In article <5s8Dq2w163w@micasa.UUCP> jzl@micasa.UUCP (Jack Z. Lupic) writes: >ahegde@mipos2.intel.com writes: > >> >> Hello there, >> i have a public domain `vi` editor for PC and it >> gives the following logo when invoked : >> >> ------------------- >> by Jim Goodnow II >> version 1.2 >> 7/11/85 >> >> (c) 1984, 85 Manx Software Systems, Inc. >> -------------------- >> >> There is a peculiar problem with this program. Its original size >> should be around 25-30K (it is a .exe file). Every time this >> program is invoked, ITS SIZE INCREASES BY exactly 1808 bytes. > >Maybe it's has a virus in it.Try scanning it with SCAN.EXE from McAfee >and let us know what it tells you. > > >Jack Lupic STOP! TURN OFF YOUR MACHINE! er, sorry for the panic ... I will bet very large odds your PC is infected with the Jerusalem B virus, or one of its kin. JB modifies executables so that they increase in size with successive infections, generally by 1808 bytes (though I've seen 1807 and 1820 as well). If vi is increasing in size each time you run it, then JB is resident in your computer's memory. As suggested by Jack Lupic, McAfee Associates' SCAN program is a sure way to detect this virus. However, you should turn off your PC first, since while the virus remains in memory, it will infect every program you run. Turning the machine off and on will wipe it from memory. Boot from an original, WRITE-PROTECTED DOS disk. Also, check any diskettes that have been in and out of your floppy drives recently. McAfee Associates make several virus detection and removal programs, see the documentation provided with the programs. They're available on simtel 20 and wuarchive. I am not affiliated, etc., etc., except as a satisfied customer. >>> terry <<<
otto@tukki.jyu.fi (Otto J. Makela) (10/03/90)
In article <473@kaos.MATH.UCLA.EDU> terry@julia.math.ucla.edu (Terence J. McKiernan) writes: >ahegde@mipos2.intel.com writes: >> Hello there, >> i have a public domain `vi` editor for PC and it >> gives the following logo when invoked : >> ------------------- >> by Jim Goodnow II >> version 1.2 >> 7/11/85 >> (c) 1984, 85 Manx Software Systems, Inc. >> -------------------- >> There is a peculiar problem with this program. Its original size >> should be around 25-30K (it is a .exe file). Every time this >> program is invoked, ITS SIZE INCREASES BY exactly 1808 bytes. I will bet very large odds your PC is infected with the Jerusalem B virus, or one of its kin. JB modifies executables so that they increase in size with successive infections, generally by 1808 bytes (though I've seen 1807 and 1820 as well). Nothing about the viruses (I left the quotes in just to be sure), but... The vi program is distributed with the Manx Aztec C compiler nowadays, under the name 'z'. Are you QUITE sure this (oldish) version is PD ? You normally don't see (c)'s in PD programs... -- /* * * Otto J. Makela <otto@jyu.fi> * * * * * * * * * * * * * * * * * * */ /* Phone: +358 41 613 847, BBS: +358 41 211 562 (CCITT, Bell 24/12/300) */ /* Mail: Kauppakatu 1 B 18, SF-40100 Jyvaskyla, Finland, EUROPE */ /* * * Computers Rule 01001111 01001011 * * * * * * * * * * * * * * * * */