) (06/01/89)
VIRUS-PLEA 1/4
Hello, my name is Bill Hadley. I would like to ask a favor of the readers
of VIRUS-L. I am doing research (which will hopefully become a book) on
computer viruses and computer security. I what I would like you to do, is
to write me a letter if you have ever had an experience with a virus or trojan
horse program. What I would ask that you include in your letter is:
Name of the Virus or Trojan Horse.
What computer and operating system does
this virus/trojan horse exist on.
What did the virus/trojan horse do.
How did you deal with it.
Where did this happen (ie. George Mason
University in Fairfax, Virginia...or
company name..whatever..).
What is your name (if you don't mind if I
put it in a section of names in the back
of my book).
If you would please answer these questions and send them directly to
me, WLHADLEY@GMUVAX.GMU.EDU (not VIRUS-L), I would greatly appreciate it.
This will assist me on trying to track what viruses have spread and how.
If you have had problems with more than one of these evil programs, then
answer these questions for each virus/trojan in your letter (even the
Internet Worm which struck last November). If more than one person writes
me from one node with the same information, that is okay...it will help me
in the verification of virus reports. Please only answer this message once.
I will try to post it once a month for the next three or four months to try
to catch new readers. I realize that I will receive alot of mail, I have
already tried to make room for that. I thank you in advance for your
assistance. I will post to the list any thing I find of urgent importance
to the readers of VIRUS-L.
Again, thank you for your time.
Bill Hadley
WLHADLEY@GMUVAX.GMU.EDU
WLHADLEY@GMUVAX2.GMU.EDUd85-ben@sm.luth.se (Johan Bengtsson) (06/09/89)
Name of Virus: Israeli Virus (I belive) Computers/OS: Does run on IBM compatibles with DOS operating system. (though not when using the Novell network, interupt conflict) Virus activity: After infection, every program run received a copy of the virus. One type of executables (EXE files) were infected many times. This led to the eventual discovery of the virus. The sick systems did have a "symptom"; about two times each hour a small part of the screen was blanked out. Each Friday 13th, after an initial delay of about 30 min, *every* program run was *deleted*. This did not happen to us, countermeasures were applied in time. Countermeasures:A "vaccine" was developed by me, after disassembly of the virus code. This detected and prevented further infections. An "antidote" program was developed by the Comp. Dep. which was able to restore most infected programs. Later, we discovered that a "vaccine" and "antidote" had already been developed at an Israeli University. Place of events:University of Lulea, Sweden, October 1988 My name: Johan Bengtsson, at the time a last year student in Comp. Sc. Good luck with the book! - --BEN - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Johan Bengtsson University of Lulea, SWEDEN Forskarvagen 149B S-951 63 LULEA Domain: d85-ben@luth.se SWEDEN Path: mcvax!enea!luth.se!d85-ben - - - - - - - - - - - - - - - - - - - - - - - - - - - - -