[comp.virus] 123 virus

IA96%PACE.BITNET@VMA.CC.CMU.EDU (IA96000) (09/26/89)

for lack of a better name and until/if someone objects with a
legitimate reason, i feel the name for the virus targeted
at release 3 of lotus 123 should be called 123nhalf since it
causes your spreadsheet to be saved exactly one half the size
it should be.

in any event, an update is in order. we have now discovered that
this virus will only, repeat only infect the 123dos.exe file,
when running on a machine with a '286 processor. it will not
infect the file on a '386 system. we are attempting to determine
the exact reason for this strange coincidence. it is felt at the
current time that the way a '386 creates virtual machines may
have something to do with it.

the virus also will not infect files unless there is a minimum
of 3 megabytes of extended memory. expanded memory does not matter
and does not come into the picture.

a scan program is now available which quickly checks the 123dos file
in three different locations to determine if the virus is present.
a copy is on the way to mr. mcafee of mcafee associates for his
observations.

hopefully mr. mcafee will post it on homebase so the rest of the
readers can benefit from this program. the name of the scan program
is 123scan.exe and it should be at mcafee associates bythe end of
this week.

we have no way of uploading to the mainframe here, so i cannot
convert it to a .uue file for transit through the nets. however
the program is shareware and will soon be available.

for those of you who are not familiar with this virus, it infects
the large file named 123dos.exe which is now used in release 3
of lotus 123. there is only one symptom, but that is all this one
needs.

if your copy of 123dos.exe is infected, no matter what size
spreadsheet you create and save, it will only be saved as one
half the size.

in other words, a 100 x 100 cell spreadsheet will only be saved
as a 50 x 50 cell spreadsheet. as you can imagine this can be
quite a problem.

well, that's it for now!

David.M..Chess.CHESS@YKTVMV (09/26/89)

Not sure I entirely understand this; if the virus infects -only-
123DOS.EXE, how did you get it?  How would it spread?   (Why, that
is, would an infected copy of 123DOS.EXE ever find itself running
with access to an uninfected copy; why would there ever be two
different copies of the file on the same machine?)           DC