[comp.virus] WP Virus?

HAHM5247@iscsvax.uni.edu (12/11/90)

SSAT@PACEVM.BITNET (Jean F. Coppola) writes:
>Does anyone know of a WordPerfect virus that the document duplicates
>itself within the document and if you try to go to the end of the
>document it takes a very long time and then goes to the top of the
>document...I have seen this happen 3 times to 3 people in the last
>couple of days and was wondering if such a virus exists?

jkelly@violet.berkeley.edu (John Kelly) writes

>I wonder, too.  I have seen this and another strange thing with
>WordPerfect:  floppy disks' FATs get completely scrambled.  It
>could be user error, but at least some of the half-dozen users
>I've seen this happen to are too competent to pull this sort of
>screwup on their own.

>You don't mention what version of WP you're using or what the
>overall environment is.  Our problems started with the
>installation of WP 5.1 on a Novell Netware LAN.  SCAN has not
>turned up anything.  WP being the hog it is, and somewhat new to
>the network world, I more than half suspect that this is a
>memory-allocation bug in WP.  Or else it's user error.   As I
>told a user's group the other day, the only way we'll find out
>is by all of us taking notes and sharing them.

- ------------------------------

I have also run into the same problem with WP5.1 files.  I think the
problem is a crosslink problem.  I read in the most recent VIRSUM that
there is the 4096 virus that can cause this type of problem but
checking with McAfee's Scan v7.1 I find there is no virus present.  I
am curious if there seems to be a problem with WP5.1 itself.  I know
of another person with the same problem.  I am curious if John or Jean
operates WP5.1 under Windows 3.00?  I have a hunch that maybe wp5.1
and Windows do not seem to get along too well.  But then this is with
any real basis, this is just a thought.

RONALD HAHM
ISCSVAX.UNI.EDU

CMLHD%UOTTAWA@acadvm1.uottawa.ca (Colin Lay) (12/13/90)

Previously sent to:
              John Kelly <jkelly@violet.berkeley.edu>,
              "Jean F. Coppola" <SSAT@pacevm.bitnet>,
              Ronald Hahm <HAHM5247@iscsvax.uni.edu>
=======================================================
jkelly@violet.berkeley.edu (John Kelly) writes:
Date:    Sat, 08 Dec 90 05:40:16 +0000

>SSAT@PACEVM.BITNET (Jean F. Coppola) writes:
>>Does anyone know of a WordPerfect virus that the document duplicates
>>itself within the document and if you try to go to the end of the
>>document it takes a very long time and then goes to the top of the
>>document...I have seen this happen 3 times to 3 people in the last
>>couple of days and was wondering if such a virus exists?

>I wonder, too.  I have seen this and another strange thing with
>WordPerfect:  floppy disks' FATs get completely scrambled.  It
>could be user error, but at least some of the half-dozen users
>I've seen this happen to are too competent to pull this sort of
>screwup on their own.

>You don't mention what version of WP you're using or what the
>overall environment is.  Our problems started with the
>installation of WP 5.1 on a Novell Netware LAN.  SCAN has not
>turned up anything.  WP being the hog it is, and somewhat new to
>the network world, I more than half suspect that this is a
>memory-allocation bug in WP.  Or else it's user error.   As I
>told a user's group the other day, the only way we'll find out
>is by all of us taking notes and sharing them.

Date:    Mon, 10 Dec 90 13:28:00 -0600
Ronald Hahm  ( HAHM5247@iscsvax.uni.edu ) adds:

>I have also run into the same problem with WP5.1 files.  I think the
>problem is a crosslink problem.  I read in the most recent VIRSUM that
>there is the 4096 virus that can cause this type of problem but
>checking with McAfee's Scan v7.1 I find there is no virus present.  I
>am curious if there seems to be a problem with WP5.1 itself.  I know
>of another person with the same problem.  I am curious if John or Jean
>operates WP5.1 under Windows 3.00?  I have a hunch that maybe wp5.1
>and Windows do not seem to get along too well.  But then this is with
>any real basis, this is just a thought.
- ----------------------------
Now, my contribution:

   I have run into similar problems with Word Perfect in 2 different
environments here at the University of Ottawa.  (No Windows involved.)

   First, we have students using WP on Novell LANs with each station
having one floppy disk.  The software resides on the server, and the
student must keep all of their own files on (a) floppy disk(s).  In the
1989/90 academic year we were running WP 5.0.  Our technicians are
convinced that at least partly problems of TRASHED FATs, and resulting
loss of files, is caused by students changing floppy disks while in the
middle of an editing session without informing WP of the change.
Perhaps the required sequence should be SAVE (F7 OR F10), then change
disk, then read directory of new floppy (F5), and then continue with new
diskette.  The problem may also come from either using timed backup or
automatic backup after a SAVE.

A second environment resulted in very similar problems.  We had a
small group of 3rd world special students (we call Pearson Fellows) for
whom we had a 6 machine lab with 2 floppies in each, but no hard disks.
Again we were using WP 5.0.  I had quite a few instances of trashed FATs
from these students.  In many cases I was able to at least partially
recover the files using NORTON and finding clusters that followed each
other (logically, if not physically).  It was a painful and time
consuming process.  Again the problem SEEMED to be that Word Perfect was
getting confused about where to put files on floppies, with our
technicians alleging that the students were randomly changing the
floppies.  I don't know.

   However, I had a similar trashed FAT problem when the student was
using Harvard Graphics.  Since the HG files are compact, recovery
was easy, again using NORTON.  I don't believe that disk changing was
a problem in this case.

   We scanned our software and data disks using the then current
versions of McAfee's SCAN and did not identify any viruses.

   I was present once when something like Jean Coppola's problem
occurred to one of our Pearson fellows.  WP seemed to take over when I
did a search to end of file (my memory of exact sequence is hazy).  The
result was multiple copies of the file.

   For all of these problems Word Perfect hot line consultants could
only suggest that maybe there were problems caused by an unusual
combination of keyboard and machine interacting with the software to do
strange things.  Our machines are non-brand-name clones.

Colin M. Lay,Assoc. Prof.
Fac. of Administration, Univ. of Ottawa
Tel. (613)564-7015  FAX (613) 564-6518
"Any opinions expressed are mine, not necessarily those of my employer."
Acknowledge-To: <CMLHD@UOTTAWA>

GEOTECH@VM.UoGuelph.CA (12/13/90)

I encountered the similar prolblem in WP 5.0 and WP4.2.  I posted a
message on the WP50-L and found many other people had encountered the
same thing. The following summarizes what I have found:

Apparently the WP file becomes corrupted by having an
unknown code inserted. This code cannot be deleted by WordPerfect.
Using WP doctor will clean the file or Norton Utilities to blank out
the bad code. As to the cause of the unknown code(s) ?

I would like to find out more about the 4096 virus, what does it infect
and how to get rid of it.   Thanks in advance.

 Cory Sanders   University of Guelph, Guelph Ontario

 GEOTECH@VM.UoGuelph.CA