[comp.virus] Possible virus alert

S72UZAW@TOWSONVX.BITNET (Yahn Zawadzki) (03/14/90)

        This maybe should have been directed at Virus-Alert, but I am
not too sure:
        I am running an AT clone with a 20M (8425) Miniscribe drive.
I have noticed how the drive power fails (you can hear the drive
whine, power light goes off) every 4-6 minutes if the system clock is
between 4 and 11 pm (at least that's what I tested 'succesfully').  If
the clock is changed, nothing happens.  Boot sector looks OK, booting
from a floppy eliminates the problem.  None of my .exe and .com files
have increased in length, no new files were addes, the only software I
use is either from vendors or Simtel.  I have not imported any new
packages within last 2-3 months.  I have low-level formatted the
drive, and restored all programs from originals (and Simtel).  System
seems to be OK now.  None of my files were deleted, none of the
programs seems to have been changed (I run a homemade bit comparison
on the last backup and original executables).  The only damage done by
this 'something' was during a save or read operations, where the
computer would respond with 'drive read error' (or 'drive not ready').
        Has anyone else experienced this sort of a problem?  I
strongly suspect a virus, since all evidence seems to point to a
clock-checking code.  On the other hand, I cannot find a trace of the
viral code.  I still have the backups, but I have not been able to
reproduce the error (stores itself on the hard drive only..???).  One
more thing: the number of the bad sectors has increased significantly
in the past 2 months.  Nothing outrages, but significant.  I analysed
the bad sectors, but they are just filled with '@'s (all except the
ones present when I bought the drive).  I would appreciate any advice,
as I expect that a vendor copy of one of my programs may contain the
viral code...

Thanks.
Jan Zawadzki
S72UZAW @ TOWSONVX (bitnet)
yahn @ MIDGET.TOWSON.EDU (internet)