[comp.virus] Windows Trojan ?

padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson) (10/12/90)

	Have not had a chance to verify yet but want to pass on a
warning: Received a file that alledgedly sets the cursor in Windows.
The file is contained in WINCURS.ZIP and is called CURSE.EXE. It is
Windows aware and will not run under plain DOS except to print a
message.

	According to the user, when run under Windows, it modifies the
LOAD= command in the .INI file so that it is always executed. It is
said that any information that was in the LOAD= section is trashed.

	Once invoked, files appear to have a copy of the first FAT
sector written randomly into them. It is said that this affects ANY
file (executable or data). After a period of time (from the
description) the FAT is destroyed.

	I have a copy of the file & as soon as it can be properly
examined, I will post a full description.

					Padgett