[comp.virus] WP viruses

SSAT@PACEVM.BITNET (Jean F. Coppola) (12/06/90)

Does anyone know of a WordPerfect virus that the document duplicates
itself within the document and if you try to go to the end of the
document it takes a very long time and then goes to the top of the
document...I have seen this happen 3 times to 3 people in the last
couple of days and was wondering if such a virus exists?

jkelly@violet.berkeley.edu (John Kelly) (12/08/90)

SSAT@PACEVM.BITNET (Jean F. Coppola) writes:
>Does anyone know of a WordPerfect virus that the document duplicates
>itself within the document and if you try to go to the end of the
>document it takes a very long time and then goes to the top of the
>document...I have seen this happen 3 times to 3 people in the last
>couple of days and was wondering if such a virus exists?

I wonder, too.  I have seen this and another strange thing with
WordPerfect:  floppy disks' FATs get completely scrambled.  It
could be user error, but at least some of the half-dozen users
I've seen this happen to are too competent to pull this sort of
screwup on their own.

You don't mention what version of WP you're using or what the
overall environment is.  Our problems started with the
installation of WP 5.1 on a Novell Netware LAN.  SCAN has not
turned up anything.  WP being the hog it is, and somewhat new to
the network world, I more than half suspect that this is a
memory-allocation bug in WP.  Or else it's user error.   As I
told a user's group the other day, the only way we'll find out
is by all of us taking notes and sharing them.

MONAT%UOTTAWA@acadvm1.uottawa.ca (12/11/90)

>VIRUS-L Digest   Monday, 10 Dec 1990    Volume 3 : Issue 198
>
>From:    jkelly@violet.berkeley.edu (John Kelly)
>
>SSAT@PACEVM.BITNET (Jean F. Coppola) writes:
>>Does anyone know of a WordPerfect virus that the document duplicates
>>itself within the document and if you try to go to the end of the
>>document it takes a very long time and then goes to the top of the
>>document...I have seen this happen 3 times to 3 people in the last
>>couple of days and was wondering if such a virus exists?
>
>I wonder, too.  I have seen this and another strange thing with
>WordPerfect:  floppy disks' FATs get completely scrambled.  It
>could be user error, but at least some of the half-dozen users
>I've seen this happen to are too competent to pull this sort of
>screwup on their own.
>etc......

We resolved 99 percent of the scrambled FATs in WP 5.0 this way:
disable the automatic save feature of WordPerfect. It is better anyway
to train users to back-up often their data under the name they want
instead of training them how to recuperate a backed-up file (they
never remember how to do that).

There were two situations causing the FAT problems:
1. Novell network, stand-alone WP 5.0 version, dos 3.3, clone PCs
   automatic back-up, workstations without hard disks (floppies only).
   (can't remember anymore if the back-up was creating a file on the
   server or on the user's floppy).
2. Stand-alone PCs (clones), dos 3.3, two-floppy version of WP 5.0,
   automatic back-up unto a floppy.

In both cases, we couldn't isolate the exact sequence of event leading
to the scrambled FATs but it is related to "asking WP to do to many
tasks at the same time" such as printing, saving and editing all at
the same time and maybe to the dangerous procedure of changing floppy
at the wrong time (such as when you're looking at a directory with F5
and changing floppy without going back to your document first).

Paul M. Monat     Lab Manager                   Phone: 613-564-6895/6500
                  Faculty of Administration       Fax: 613-564-6518
                  Canada    K1N 6N5            Bitnet: Monat @ Uottawa

sigurd@chopin.udel.edu (Sigurd Andersen) (12/20/90)

SSAT@PACEVM.BITNET (Jean F. Coppola) writes:
: Does anyone know of a WordPerfect virus that the document duplicates
: itself within the document and if you try to go to the end of the
: document it takes a very long time and then goes to the top of the
: document...I have seen this happen 3 times to 3 people in the last
: couple of days and was wondering if such a virus exists?

I have seen this happen, but it seems due to a corrupted document,
not an infected program.  So it's NOT a virus (not by any definition
I know of), but the result of a problem WordPerfect has with a file
that's been corrupted in some (unclear exactly how) way.

I have been able to correct this in many cases (but not all if I
remember right) in one of two ways:

- -- using Norton Utilities to save the blocks containing the file
   up to close to, but not all the way to, the end; or
- -- in WordPerfect by (getting rid of extraneous or confusing embedded
   codes and) blocking from the start of the document to somewhere
   before the end of the file and saving that as a file.

(I'm not sure getting rid of the extraneous codes was necessary to
solving the problem - but doesn't hurt in any case.)

	Sigurd Andersen              Internet:
	Academic Computing Support    sigurd@brahms.udel.edu
	University of Delaware       Bitnet: ACS20833@UDELVM
	Newark, DE 19716             phone:   (302) 451-1992