[comp.virus] Strange Behavious

N7FRJ@locke.hs.washington.edu (11/08/90)

XT and AT class PC's running MS-WORD version 5.0B on an Advanced
Netware 286 Version 2.15c LAN in Seattle have either 'crashed' while
attempting to save the document they were working on, or have received
a message saying:
  "You SHOULDn't print this file"
when they attempt to print it...  This started on 1-Nov-90, (I noticed
thhalloween notice a couple days back) and thought i would report this
as well.

Other known symptoms so far have been: At least 2 unrelated executable
files have been 'altered'.  Unfortunately, several users had
SUPERVISOR priv's.  The executable file MENUPARZ.EXE (in the PUBLIC
directory) had several chunks of it 'zeroed'.  It's date and size were
not changed, only it's contents.  It was flagged as ROS.  (But with
SUPERVISOR priv's, you can do anything, right?)

I was contacted in an attempt to 'quantify' what was going on.
All comments are appreciated!

George Saba

N7FRJ @ Locke.hs.washington.edu
N7FRJ @ UWALOCKE (BitNET)

news@arbi.informatik.uni-oldenburg.de (11/13/90)

I have observed a similar problem on a Novell 2.12 SFT Fileserver:
Parts of some .EXE-Files performing tape backup (it is Maynard
Software) got zeroed out. The userid under which backup was running
had write previliges on the directory containing the executables.

The problem was first observed after one year running without any
problems, it occured about one month ago.

- --Christian
- --
Christian Kuehnke   * Christian.Kuehnke@arbi.informatik.uni-oldenburg.de
Hartenscher Damm 65 *
D-2900 Oldenburg    * Earn/Bitnet: 249923@DOLUNI1
FRG ("W.-Germany")  * Voice      : +49 (0)441 592 652