[comp.virus] New

sturdee@troa02.enet.dec.com (Peter Sturdee) (04/13/90)

    A friend of mine sent me this request for information.  I, not knowing
    the answer, am forwarding it to you people.  The entire message
    follows.  Replies can be sent to me.

    Thanks, alot, really,
    Peter Sturdee

- ------< Start of message >------

From:	DECPA::"alopez-ortiz@trillium.waterloo.edu" "Alex Lopez-Ortiz" 12-APR-1
990
 15:46:16.17
To:	troa02::sturdee
Subj:	Virus Attack!

Pete,

  Do you know of a virus that does this?

Wipes Boot sector on "C" Drive to 0's
Erases every directory entry (including subdirecty entries)
from every directory of the disk (by puting the Delete char as
first character in the file/directory name)

Kills all FAT copies on "C" drive
changes the date and size of IBM PC-DOS V3.3 from 25307 -> 25324 (increase)
and dates from 3-17-87 to 11-27-89 at 12:00.

We recovered the machine with Norton and PCTools.. but a virus scan
doesn't get anything.. mind you we might not have the latest edition
of the scanner...

Have you read anything about this type of one?  We still can't figure out
what program spawed the virus.

Alex

- ------< End of message >------