[comp.virus] Ws and Ps now you see em....

Ullrich_Fischer@mindlink.bc.ca (Ullrich Fischer) (06/12/91)

The following problem has occurred on our network over the past two days:

On Monday, a user showed us two printouts from WordPerfect 5.1
(Network version) printed from the same document about 5 minutes
apart.  She swears she made no changes to the document between the two
printouts.

On one printout all the Bitstream Dutch 11 point (we use Bitstream
fonts on HP Laserjet II printers) 'w's (upper and lower case) were
missing (i.e.  replaced by relatively narrow blank spaces).  On the
2nd printout, the 'w's were all there.  At the top of the document, a
large capital W using a different font appeared in both printouts.  It
is a one-page document.

Today the same sort of thing happened to another user on a different
PC using Lotus 2.01 networker.  This time the 'p's were missing from
one printout but not another of the same spreadsheet.

We are using Novell Netware 2.15C on an internet with a 3.1 server.
These incidents happened to people who were using the 2.15C to store
their data files and the application software.

We are using Printer Assist from Fresh Technologies to print to the
laser printers.  The two incidents involved different printer servers
and printers as well as different PCs.  Both PCs used DOS 3.3

I scanned the network and both PCs involved using McAfee's SCAN
version 77 but turned up no indication of any virus infection.

To the best of my knowledge, this is the first time anything like this
has happened on our network.

No, I am not sure this is a virus, but it seems the kind of thing that
malicious code might do.  If anyone has any ideas as to what may be
going on here, I would be grateful to hear them.

- - Ullrich Fischer@mindlink.bc.ca   (Let's just have 1 line signatures eh?)