motu_7a@wmms-srf-yoko.arpa (DSC T. DEJANE) (06/15/89)
We have discovered a PC virus on campus. It is readily apparent in
WordPerfect 4.2 applications which refuse to run from the C: drive and
display the error:
Can't find correct copy of WP.EXE
Enter full path and filename (Example: C:\WP\WP.EXE)
It appears as though at least one other university campus has a similar
problem (see messages below). This virus infects .EXE and .COM files
when you run them; it does not appear to infect the IBM*.COM and
COMMAND.COM files stored on disk. We are conducting further
investigations and hope to have more information in the near future.
==== Begin forwarded messages ====
Original-From: CANDIE@PACEVM.BITNET (Jenny Wirtschafter)
Original-Subject: Possible Virus Encountered (PC)
Original-Date: 2 Jun 89 15:37:26 GMT
Hi-
Recently we began noticing a problem on some of our software,
specifically WordPerfect. On all of our WordPerfect disks we get the
error can not find correct copy of WP.EXE. If an infected disk is
used on a machine without rebooting it infects all disks used
subsequently. The disks are infected immediatly, there is no latency
period. Another symptom we have noticed is the monitor will display
snow and start scrolling/clearing the screen at random intervals.
When infected disks are reformatted they have numerous bad sectors.
We are worried that the virus might be infecting all of our disks. It
might be surfacing on the Wordperfect disk, because they must be used
without a write protect tab. Or possibly the sectors which the virus
first infects are necessary to WordPerfect performing correctly. Has
anyone else encountered this problem? Does anyone have any ideas on
how we should proceed? Any help would be greatly appreciated.
Jenny Wirtschafter
Academic Computing
Original-From: IA96@PACE.BITNET (IA96000)
Original-Subject: Warning New Virus (PC)
Original-Date: 8 Jun 89 22:34:00 GMT
Just thought you all might like to know the following:
There is a new virus floating around, which attacks WP.EXE in
particular and almost every other .EXE file it comes in contact
with. It is self propogating and trashes files and disks.
Some of the things to look for are as follows:
1) Strange blue/green blocks appear on the screen.
2) Running a .EXE you know is on the disk and getting a
"File not found" error even though the .EXE is on the disk.
3) After 30 to 45 minutes everything seems to slow down. Doing
a DIR takes 30 or 40 seconds for each line to appear.
4) It definitely spreads between .EXE files, although it appears
.COM files are immune. [Nope, .COM files aren't immune. - Lance]
5) It will spread to all types (sizes) of floppy disk drives
and will jump to a hard drive.
More later...
==== End forwarded messages ====
If anyone has further information on (or experiences with) this virus,
please post it here, on comp.virus, or directly to us here at Stanford
(goodrich@jessica.stanford.edu or gx.tsg@stanford.bitnet) and we'll
compile the results and post them.
Lance Nakata and Tom Goodrich
Academic Information Resources
Stanford Universityrmorey@ORION.CF.UCI.EDU (06/16/89)
RE: Word Perfect viruses
Hi,
The only time I have ever had a Word Perfect problem like that was
when someone was running TUTOR.COM and did not have WP.EXE in the
TUTOR subdirectory (WP Corp. instructs people to create a separate
subdirectory for TUTOR). By making a copy of WP.EXE to the TUTOR
directory or by copying all the Tutor files into the WP directory,
this error would no longer occur.
Also, Word Perfect 5.0 had a series of bugs on its first release which
I contacted the company about--we received two updates. I wasn't into
Word Perfect when version 4.2 came out but I wouldn't be surprized that
the earlier releases had some bizarre bugs too. Have you contacted the
Word Perfect Corporation?
Hope this helps,
Robert J. Morey