[comp.virus] 123 protected mode virus

IA96%PACE.BITNET@VMA.CC.CMU.EDU (IA96000) (09/19/89)

It would appear that a new virus is on the scene. it seems that
some strain attacks >only< the large (700k+) plus file supplied
with lotus 123 version 3.

basically what happens seems to be as follows:

1) The file grows in size (one time) by 3907 bytes.
2) Any spreadsheet saved after the virus has infected the file
   is exactly half the size of what it should be. in other words
   if you have a spreadsheet 100 x 100 cells in size, after you
   save it and then retrieve again, it is exactly 50 x 50 in
   size.
   I call this a virus because the file does grow in size one time
   and if you erase the file, restore the file from a backup and
   run lotus again, the file grows again in size.

   It also seems to cause files which run in protected mode/dos
   mode to grow as well. makes me feel that this is a virus
   geared to extended memory programs.

in any event as soon as the code is isolated i will make it
available to homebase so they can figure out a test to see if
it is present.

this has not damaged anything at the univerisity. this is strictly
on observation based on outside experiences.

w.r.