RADAI1@HBUNOS.BITNET (Y. Radai) (06/28/89)
As some of you may already have read in the press, a new PC virus,
the "Mistake" virus, has been reported in Israel. As I have already
been getting inquiries about it, I thought I might as well publish
what I know, even though I haven't yet seen it, so that what I report
here is second-hand info.
Its main symptom is that certain characters in printouts are re-
placed by others. In the case of letters, the replacement is always
by another letter which is pronounced similarly, e.g. K by C. The
same thing happens with Hebrew letters (which on Israeli computers
replace the foreign letters at Ascii 128-154), making it almost
certain that the virus was authored by an Israeli. Digits are also
replaced. The virus has been reported in banks in Tel Aviv and at the
Univ. of Tel Aviv. According to a newspaper report, the virus even
caused the Hebrew equivalent of the following sentence to be printed:
"4 times 4 equals 16, more or less" (there was no indication of what
the undistorted original was). (Note: Replacements do not appear on
the screen or in files, only in printouts.)
So much for the symptoms. As to the mechanism, it's said to be a
boot-sector virus installing itself in 2K at the upper end of RAM.
It may be a mutation of the Ping-Pong (Italian) virus. In any case it
has been removed by a program designed to remove the P-P virus. As
with other boot-sector viruses, it could presumably be wiped out also
by performing SYS on the infected disk (immediately after a cold boot
from a clean DOS diskette).
Y. Radai
Hebrew Univ. of Jerusalem