[comp.virus] Mysterious messages

frisk@rhi.hi.is (Fridrik Skulason) (08/28/90)

Does the number "7106286813" look familiar to anybody ?  It is found
inside the Bulgarian "1024" virus, but does not seem to have any
obvious purpose.  A Bulgarian identification number maybe - perhaps a
date + something else - any Bulgarian programmer born on 7-10-62 ?
:-)

At least this is not a phone number.....  :-)

Does the text "Sudah ada vaksin" mean anything in any language ?  It
looks like Arabic to me.  This text is found inside the French "Mardi
Bros" virus.

I believe I asked about this before - there are some mysterious
messages inside the JOCKER.EXE program (which may or may not be a
virus)

Call (209) 683-6858 !                   Does this number exist, and if so,
					to whom does it belong ?

West Lake Software and Data Research, WA 0108077, New Orleans, (c) 1986

					Does this company exist, and if so,
					do they know anything about the
					JOCKER.EXE program ?

KONIEC PROGRAMU WABIKEXE.EXE            This looks like Polish - does "Koniec"
					mean anything in that (or any other)
					language ?

EIGALY@yubgef51.BITNET (Cedomir Igaly) (08/31/90)

>KONIEC PROGRAMU WABIKEXE.EXE            This looks like Polish - does "Koniec"
>                                        mean anything in that (or any other)
>                                        language ?

It can be Polish, but I'm not sure. Anyway, this mean simply
"End of the program".
                                Cedomir Igaly
                                Inst. of Inf. Sci.
                                Zagreb - Yugoslavia

RZOTTO@DKNKURZ1.BITNET (Otto.Stolz) (09/10/90)

Finally I've seen Frisk's original poster (which I had missed before)
and hence the whole message
   KONIEC PROGRAMU WABIKEXE.EXE
meaning
   End of the WABIKEXE.EXE program

>From the name of the program ended thus, it's clear that this message is
Polish, as Slovac does normally not use the W. The name contains the
Polish word WABIK which means BAIT -- a natural name not for a virus,
but rather for a program offered to the virus to be infected.

Hence I conjecture, the specimen consists of a simple bait program
(written from a Polish person, and ending with the above character
string) that has been infected by the virus in question.

That's definitly my last word on this topic, I promise!
Ihth
     Otto

dittrich@milton.u.washington.edu (Dave Dittrich) (09/10/90)

frisk@rhi.hi.is (Fridrik Skulason) writes:
>
>Call (209) 683-6858 !                   Does this number exist, and if so,
>					to whom does it belong ?
>
>West Lake Software and Data Research, WA 0108077, New Orleans, (c) 1986
>
>					Does this company exist, and if so,
>					do they know anything about the
>					JOCKER.EXE program ?

I know this is going to sound too simple, you can verify the
authenticity of a phone number (at <= same cost as posting and
article) by calling the number using a standard telephone.  Also, the
United States Postal Service will help you in finding out if an
address is correct.  All you have to do is put the address on the
front of a postcard, along with $0.20, and if it comes back marked "No
such address," you have your answer.  (You can even ask that the
person reading the letter tell you what they know about JOCKER.EXE.)

:-), of course.
- --
Dave Dittrich		INTERNET: dittrich@u.washington.edu
(206) 685-2438		UUCP:	  ...uw-beaver!u.washington.edu!dittrich
Dept. of Chemistry, University of Washington

felton@uunet.uu.net (09/14/90)

Fridrik Skulason writes:
|>
|> [deleted info about Bulgarian "1024" virus]
|>
|> I believe I asked about this before - there are some mysterious
|> messages inside the JOCKER.EXE program (which may or may not be a
|> virus)
|>
|> Call (209) 683-6858 !                   Does this number exist, and if so,
|> 					to whom does it belong ?

   This number is an old Sierra Online Support Number...
   Now all you get is a recording about their new 900 number.

- --
Ed Felton                  | When you wish to produce a result by means of an
uunet!sci34hub!eng3!felton | instrument, do not allow yourself to complicate it
                           |                          -- Leonardo da Vinci
        Disclaimer: Even if I had opinions, who would want them???