Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!apple!bionet!ig!ames!ncar!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!ubu.cc.lehigh.edu!virus-l From: motu_7a@wmms-srf-yoko.arpa (DSC T. DEJANE) Newsgroups: comp.virus Subject: Forward of Virus Warning recieved from PCSUPT List Message-ID: <0001.8906142056.AA15485@spot.CC.Lehigh.EDU> Date: 14 Jun 89 23:05:07 GMT Sender: Virus Discussion List Reply-To: VIRUS-L@IBM1.CC.Lehigh.EDU Lines: 73 Approved: virus-l@ubu.cc.lehigh.edu We have discovered a PC virus on campus. It is readily apparent in WordPerfect 4.2 applications which refuse to run from the C: drive and display the error: Can't find correct copy of WP.EXE Enter full path and filename (Example: C:\WP\WP.EXE) It appears as though at least one other university campus has a similar problem (see messages below). This virus infects .EXE and .COM files when you run them; it does not appear to infect the IBM*.COM and COMMAND.COM files stored on disk. We are conducting further investigations and hope to have more information in the near future. ==== Begin forwarded messages ==== Original-From: CANDIE@PACEVM.BITNET (Jenny Wirtschafter) Original-Subject: Possible Virus Encountered (PC) Original-Date: 2 Jun 89 15:37:26 GMT Hi- Recently we began noticing a problem on some of our software, specifically WordPerfect. On all of our WordPerfect disks we get the error can not find correct copy of WP.EXE. If an infected disk is used on a machine without rebooting it infects all disks used subsequently. The disks are infected immediatly, there is no latency period. Another symptom we have noticed is the monitor will display snow and start scrolling/clearing the screen at random intervals. When infected disks are reformatted they have numerous bad sectors. We are worried that the virus might be infecting all of our disks. It might be surfacing on the Wordperfect disk, because they must be used without a write protect tab. Or possibly the sectors which the virus first infects are necessary to WordPerfect performing correctly. Has anyone else encountered this problem? Does anyone have any ideas on how we should proceed? Any help would be greatly appreciated. Jenny Wirtschafter Academic Computing Original-From: IA96@PACE.BITNET (IA96000) Original-Subject: Warning New Virus (PC) Original-Date: 8 Jun 89 22:34:00 GMT Just thought you all might like to know the following: There is a new virus floating around, which attacks WP.EXE in particular and almost every other .EXE file it comes in contact with. It is self propogating and trashes files and disks. Some of the things to look for are as follows: 1) Strange blue/green blocks appear on the screen. 2) Running a .EXE you know is on the disk and getting a "File not found" error even though the .EXE is on the disk. 3) After 30 to 45 minutes everything seems to slow down. Doing a DIR takes 30 or 40 seconds for each line to appear. 4) It definitely spreads between .EXE files, although it appears .COM files are immune. [Nope, .COM files aren't immune. - Lance] 5) It will spread to all types (sizes) of floppy disk drives and will jump to a hard drive. More later... ==== End forwarded messages ==== If anyone has further information on (or experiences with) this virus, please post it here, on comp.virus, or directly to us here at Stanford (goodrich@jessica.stanford.edu or gx.tsg@stanford.bitnet) and we'll compile the results and post them. Lance Nakata and Tom Goodrich Academic Information Resources Stanford University