Alan_J_Roberts@cup.portal.com (08/07/90)
This is a forward from Aryeh Goretsky of the Computer Virus Industry Association: ================================================================ Note: Contact information from the following CVIA Membership Alert has been removed from the posting, but has been submitted separately to the Virus-L moderator. August 6, 1990 CVIA Membership Alert Originating Members: [Information Removed] Alert Type: Initial Infection Spread Library Entries: AirCop; 1253; Leprosy Entry Types: Boot Sector; Multipartite; COM Infector The second U.S. occurence of the AirCop virus was reported from Fremont, California on August 3. The virus had infected a retail software distributor on multiple machines. The virus appears identical to the original AirCop reported by Microsoft. The virus was traced back to a software duplicator in Taiwan. An unusual virus, called the 1253 virus, has been reported in Austria and submitted to the CVIA library. The virus infects COM files, floppy diskette boot sectors, and hard disk partition tables. Either of the three forms of the virus are sufficient to transfer an infection to the other. In its COM infector form, it increases the size of infected files by 1253 bytes. The virus activates on December 24th and corrupts all data on the hard disk and on any inserted floppies. An interim detector for the virus is available now to liaison persons. The Leprosy virus has been reported at 11 separate sites in Northern California within the past five days. The outbreak appears to stem from a file uploaded to bulletin boards within the Bay Area called 486COMP.ZIP, which promises to compare the user's system to a 80486-based PC. The Leprosy virus is a slow replicator and there is little chance of contracting this virus ouside of the BBS channels or from an intentional infection. A detector is available, however, for liaison persons if requested. John McAfee