[comp.virus] Possible virus

MATHRICH@UMCVMB (Rich Winkel UMC Math Department) (06/09/89)

>        Another wierdness (or maybe not).  If you are (BY THE WAY, WE
>ARE TALKING ABOUT IBM CLONES) booting up from a bootable diskette (not a
>full DOS disk) with no config.sys file, does it get the files and buffers
>limits from the dos disk that originally made the bootable disk?  It
>must, obviously.  Where does it keep this stuff?

No, it just uses default values hardcoded in dos.  The default for buffers
is 2 for a PC, 3 for an AT. The default for files is 8.

Rich

wb@cbnewsj.ATT.COM (werner.baumgartner) (02/28/90)

I recently down-loaded a file from a local BBS called MEGASPUP.ZIP
which is flagged by SCAN58 as containing 2 viruses, 1701/1704 Ver B
and Vacsina. This program is supposed to decrease disk access time,
according to the documentation. Does anyone have any information about
this file, such as its origin etc. Also, now what do I do with it,
should I send it somewhere to be analysed ?

YOOPER@MSU.BITNET (Carl_A.Fassbender) (03/17/90)

One of the public computer labs here is having trouble with it's system
disks.  For some reason, space on these disks is lost.  There are
no other files added to the disks and the file sizes of the orginal
files have not changed.  Could something be changing the number of free
blocks without actually allocating them?
The files that are on the system disk are:
   System 6.0.4               LaserWriter
   Finder                     Monitors
   Gatekeeper Aid 1.0.1       Sound
   Gatekeeper 1.1.1           StartupScreen
   Clipboard File
   Color
   General
   ImageWriter
   Key Layout
   Keyboard
   LaserPrep
We have Gatekeeper set so that it does not use the log feature.
Carl Fassbender
Michigan State University

IBNG300@INDYVAX.BITNET (SEAN KRULEWITCH) (06/06/90)

To Who it may concern:

I am fairly new to the whole idea of viruses and the like.  I recently
purchased an IBM clone (AMI motherboard 386-20) and have experienced a
few unusual things.  Files seem to be vanishing off the disk, and
other programs are acting weird.  For example when I run Windows386 I
get a KERNSTUB error during boot, and I am sent back to the dos
prompt.  When I try again, I get an incorrect Dos version error.  If I
then proceed to type ver it says Dos 3.41.  However I am running Dos
4.01.  If i type ver a few more times it continues to say dos 3.41.
After the third or fourth time it goes back to saying Dos 4.01.  Also
Procomm locks up when I try to enter the setup mode (ALT-S) and I am
forced to turn the machine off (Warm boot doesn't work).  After a
while the whole system seems to slow down considerably.  One symptom
that seems to be common is a small section of the lower left hand side
of the screen seems to shift up, leaving a small "hole".  This happens
in various programs and at the dos prompt.  I thought it may be a
problem with my video card, but the card checks out ok.  Certain
programs that worked before no longer work.  If anyone knows what this
may be, please contact me.  I can be reached at the following
addresses:

                       KRULEWIT@IUBACS.BITNET or
                       IBNG300@INDYVAX.BITNET

                                        Sincerely,
                                        Sean V. Krulewitch

CHESS@YKTVMV.BITNET (David.M.Chess) (06/06/90)

SEAN KRULEWITCH <IBNG300@INDYVAX.BITNET>:
> One symptom
> that seems to be common is a small section of the lower left hand side
> of the screen seems to shift up, leaving a small "hole".

That's a common symptom of the 1813 (or "Jerusalem") virus, one of the
most common PC-DOS viruses.  Have you used a virus-scanner on your
system?  If you *do* have an 1813 infection, the other symptoms that
you're seeing are probably due to various bugs in the virus and/or
"incompatibilities" between the virus and your various programs...

DC