frisk@uunet.UU.NET (Fridrik Skulason) (09/08/89)
Some bits of information on the Oct. 12/13 virus attacks.
DATACRIME will indeed attack on Oct. 12, but turning off your computer on
that day will not provide any protection against it. The first time an
infected program is run on Oct. 12 or after that date, the virus will
format the first few tracks of drive C: and then display the message:
DATACRIME VIRUS RELEASED: 1 MARCH 1989
On a floppy-only computer it will do no damage at all. Two major
variants of Datacrime are known to exist, one is 1168 bytes long, the
other 1280. Both variants only infect .COM files. This virus
originated in Europe, and is rare elsewhere. A new variant (Datacrime
II) has appeared recently), but little information is yet available on
it. Since I only received a copy of it yesterday I have not yet been
able to check if it will behave as the other two variants on Oct. 12.
The well-known Jerusalem virus will attack on October 13. So much has
been written about that virus that I see no need to repeat that
information here.
The South-African "Friday the 13." virus reported by Jim Goodwin will
attack on Oct. 13. This virus is very rare, and must not be confused
with the Jerusalem virus, that also has been named "Friday the 13.".
This virus will delete every program run on that date, and sometimes
display the message
We hope we haven't inconvenienced you
This virus is not a great threat, since it is very rare - in fact it
is so rare that it took me almost four months to obtain a copy.
Recently a new virus was reported by the CVIA, which will probably
activate on Oct. 13. (At least they reported that the actvation date
was Friday 13.) This virus (named the "RAP virus") has not yet been
described in detail.
One more "Friday the 13." virus is reported to exist, but it will not
become active until 1991. This is the SYS variant of the "Den Zuk"
virus.
Finally, two more viruses have been mentioned, with activation dates
on Oct 12/13.
> A West German virus, apparently discussed at a hacker's convention
> in Amsterdam earlier this month, to be introduced through BITNET.
> An enhanced version of an earlier Icelandic virus rewritten to avoid
> detection by constantly changing its location in memory."
This may be true, but so far I have not been able to confirm this.
These viruses - if they exist - are not likely to have spread widely,
and should not pose a serious threat.