[comp.virus] PC Problem?

JFORD1%UA1VM.BITNET@VMA.CC.CMU.EDU (James Ford) (10/27/89)

A friend who works a company began to experience some interesting problems
on his hard drive.  He works with JL Modula2.  Code that had run in the
past would not work now.  Someone else could put a comment in a file
(however you do that in Modula2), re-compile it, and it would hang.

I gave him a copy of Scan 1.1V45 and Scanres 1.1V45, but they found
nothing strange.  He has purchased a copy of Flushot, and the following
message is from him, describing what Flushot sees.  Can anyone explain
this?  If you need more information from him, send direct to me and I'll ask
him.  For better or worse, the powers-that-be are leaning towards taking all
source code off the hard drives, and doing a lowlevel/highlevel format of
all harddisks involved.  (I have no ideal if he has installed Flushot+
correctly, but he is by no means ignorant when dealing with computers.)

Thxs
James Ford - JFORD1@UA1VM.BITNET

===========================================================================
Sent : Oct 25, 1989  at 5:44 PM
Subj : Re: <1446> Bit

(...after running SCAN 1.1V45, it found...)

Not a thing.. it found nothing either on my systems or the ones at work.
I'm still totally convinced something is sorely amiss, however.  We
installed Flu+ and watched JPI's Mod 2 compiler/linker do all kinds of
strange calls (Flu+ labeled them as 'handle write access attempted'
operations, but they appeared to be reads... why would anyone write to a
'DEF' file during a link?  I checked them with a disk editor afterwards
and found nothing but pure ASCII text...)

I did discover one interesting thing.  When you copy a non-executable file
with COMMAND.COM, Flu is perfectly happy.  When you copy an EXE, COM, etc.
file you get the old 'handle write access attempted' msgs. Curious. Why
would COMMAND.COM care what type of file is being copied?  It seems to use
DOS to open the file and the BIOS to transfer the data or something.

The only thing I can figure with the compiler is that the program opens
the file for READ/WRITE and Flu+ flags it just to be safe.  We all got
tired of the beeping, and Dean absolutely refused to believe anything was
wrong, so everyone just kinda went back to doing their stuff and just
checked it occasionally.

Anyway, I really appreciate your uploading SCAN45 - I'm gonna keep pluggin
and see if I can find out the problem. I'm also gonna call McAffee Assoc's
board tonite and see what I can start finding out.  Thanks!

- -=Marcel=-
====================== end of note ========================================