RREINER%YORKVM1.BITNET@VMA.CC.CMU.EDU (10/20/89)
Three 5.25" DSDD floppies in my possession are reported by ViruScan 0.7V42 to be infected with the Disk Killer virus. Since my system is reported to be clean by ViruScan, and these were the disks I had with me on a recent visit to Montreal, I am assuming that that is where the infection came from. I am in the process of notifying the owners of the machines with which these disks had contact, and will post again when the source is identifed. Alan Roberts' statement in VIRUS-L of 26 Sept 89 is the only information I have been able to find on Disk Killer. Any info will be appreciated. Richard J. Reiner . BITNET ...... rreiner@vm1.yorku.ca ..... (daily) .. .................... old BITNET .. rreiner@yorkvm1 .......... (daily) .. .................... Internet .... grad3077@writer.yorku.ca . (daily) .. .................... Compu$erve .. 73457,3257 ............... (rarely) .
RREINER%YORKVM1.BITNET@VMA.CC.CMU.EDU (10/21/89)
I have now confirmed that the virus I reported in VALERT-L this morning is indeed Disk Killer. The boot sector signature, and the message texts stored elsewhere on the disk, match those reported in VIRUS-L on 26 September by Alan Roberts. There is one discrepancy: while Alan reports that the message texts are stored at sector 152 (presumably decimal) on floppy disks, on the infected disks in my possession they are at sector 354 decimal (0x162). This may therefore be a new strain. I have not yet been able to trace the source of the infection; I will post again if I succeed. Richard J. Reiner . BITNET ...... rreiner@vm1.yorku.ca ..... (daily) .. .................... old BITNET .. rreiner@yorkvm1 .......... (daily) .. .................... Internet .... grad3077@writer.yorku.ca . (daily) .. .................... Compu$erve .. 73457,3257 ............... (rarely) .