[comp.windows.ms] re Windows "virus"

LK-AP@finou.oulu.fi (10/30/90)

Hello netreaders

   If the letter "Cursor Icon foulup" was about program called "Curse"
   it may be to but warnig word also here.

   I read (from NetNews) that there might be (troyan) virus in Curse.
   (I am not sure about the name, but it is mousecursor changer.)

   The article said that there was some suspicious stuff in prg code,
   connected with HD partition tables.

   Curse will be real curse if it will mix your HD partition table.

   I hope i am not right.           Have a nice day and sleep well,
-------
    |-------------------------|---------------------------------|
    | Antti Peltonen          | Internet: lk-ap at finou.oulu.fi|
    | University of Oulu      | Bitnet:   lk-ap at finou.bitnet |
    | Computer Services Centre|---------------------------------|
    | Linnanmaa               |   This space for vice taughts   |
    | SF 90570 OULU  FINLAND  |   unintentionally left blank.   |
    |-------------------------|---------------------------------|

fc173108@seas.gwu.edu (Iqbal Qazi) (10/31/90)

In article <90303.144132LK-AP@finou.oulu.fi> LK-AP@finou.oulu.fi writes:
>Hello netreaders

[stuff deleted]

>   I read (from NetNews) that there might be (troyan) virus in Curse.
>   (I am not sure about the name, but it is mousecursor changer.)
>
>   The article said that there was some suspicious stuff in prg code,
>   connected with HD partition tables.
>
>   Curse will be real curse if it will mix your HD partition table.
>
>   I hope i am not right.           Have a nice day and sleep well,

I don't think you are.  I've been using the Curses program from cica
for about a month and have had *no* problems with it.  My hard disk is
still intact and I do sleep well (well, not after thinking about this
virus thing).  

I ask the author of the original author to please find out which
program was being talked about.

As to Curses modifying WIN.INI:  if you think about it, how else would
a program "install" itself to run when Windows starts up?  Just think
about it.  Sure maybe it should have explicitly said so but come on...

Iqbal

jls@hsv3.UUCP (James Seidman) (11/01/90)

In article <2286@sparko.gwu.edu> fc173108@seas.gwu.edu () writes:
>As to Curses modifying WIN.INI:  if you think about it, how else would
>a program "install" itself to run when Windows starts up?  Just think
>about it.  Sure maybe it should have explicitly said so but come on...

The thing that bothered me was that I had several programs mentioned in
my "load" line.  When I installed Curse, it didn't bother to read in
the list that was already there and add itself.  Rather, it just wrote
out "load = curse.exe", blasting all the other programs which were there.

-- 
Jim Seidman (Drax), the accidental engineer.
"It doesn't have to work... they'll be paralyzed just from laughing at me."
							- Dr. Who, _Shada_
UUCP: ames!vsi1!hsv3!jls	         INTERNET: hsv3.UUCP!jls@apple.com

fc173108@seas.gwu.edu (Iqbal Qazi) (11/01/90)

In article <5574@hsv3.UUCP> jls@hsv3.UUCP (James Seidman) writes:
>The thing that bothered me was that I had several programs mentioned in
>my "load" line.  When I installed Curse, it didn't bother to read in
>the list that was already there and add itself.  Rather, it just wrote
>out "load = curse.exe", blasting all the other programs which were there.

Really?  I don't think it did that to me, but then at the time, my
win.ini was in a fluid state, i.e. I was setting up and doing weird
things some maybe I didn't notice.

If so then that's really screwed up.

Iqbal

rodrigol@ulrik.uio.no (Rodrigo Lopez) (11/01/90)

In article <2286@sparko.gwu.edu>, fc173108@seas.gwu.edu (Iqbal Qazi) writes:
> In article <90303.144132LK-AP@finou.oulu.fi> LK-AP@finou.oulu.fi writes:
> >Hello netreaders
> 
> [stuff deleted]
> 
> >   I read (from NetNews) that there might be (troyan) virus in Curse.
> >   (I am not sure about the name, but it is mousecursor changer.)
> >
> >   The article said that there was some suspicious stuff in prg code,
> >   connected with HD partition tables.
> >
> >   Curse will be real curse if it will mix your HD partition table.
> >
> >   I hope i am not right.           Have a nice day and sleep well,
> 
> I don't think you are.  I've been using the Curses program from cica
> for about a month and have had *no* problems with it.  My hard disk is
> still intact and I do sleep well (well, not after thinking about this
> virus thing).  
> 
> I ask the author of the original author to please find out which
> program was being talked about.
> 
> As to Curses modifying WIN.INI:  if you think about it, how else would
> a program "install" itself to run when Windows starts up?  Just think
> about it.  Sure maybe it should have explicitly said so but come on...
> 
> Iqbal

Another thing to remember is that if one is using win 3.0 in 386 enh mode and 
with a user defined virtual memory disk, windows makes this area fixed. That is
to say unmoveable blocks.

***************************************************************************
* RODRIGO LOPEZ SERRANO              Biotechnology Centre of Oslo         *
* Tel: xx-02-958766                  Gaustadalleen 21                     *
* Fax: xx-02-694130                  P.B. 1125 Blindern                   *
* rodrigo.lopez@use.uio.no           0316 Oslo 3 Norway                   *
* rodrigo.lopez%use.uio.uninett@nac.no                                    *
* rodrigol@ulrik.uio.no                                                   *
***************************************************************************