[comp.virus] GAME2 MODULE in CERNVM

GXEXEO@CERNVM.BITNET (Geraldo Xexeo) (01/16/91)

I am sad to inform that GAME2 MODULE was received at CERNVM (altough,
not by myself). It came from the NETNWS-L list and the origin was
ERDAL@TRMETU.

As stated by the user consultancy office:
 "The code appears to be an assembler program that has an imbedded
REXX exec coded in the format that EXECLOAD would put it in memory.
The module NUCEXT loads itself and then EXECs the internal exec. If
there is no NAMES file it dies (our recipient was suspicius and tried
it on an ID with no user files)"

I hope this information can help anyone trying to trace the worm.

                        Geraldo Xexeo

Geraldo Xexeo - GXEXEO@CERNVM, XEXEO@VXCERN.DECNET.CERN.CH
Editor of HIT@UFRJ, The Highly Imaginative Tech. - Science Fiction List
"No institution would  ever be proprietary of my words!"