Path: utzoo!utgpu!jarvis.csri.toronto.edu!rutgers!uwvax!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!ubu.cc.lehigh.edu!virus-l
From: CCSDWL@UWOCC1.BITNET (David W. Loveless)
Newsgroups: comp.virus
Subject: Possible PC Virus?
Message-ID: <0009.8906161915.AA20442@spot.CC.Lehigh.EDU>
Date: 16 Jun 89 18:19:00 GMT
Sender: Virus Alert List <VALERT-L@ibm1.cc.lehigh.edu>
Reply-To: VIRUS-L@IBM1.CC.Lehigh.EDU
Organization: University of California, Irvine
Lines: 54
Approved: virus-l@ubu.cc.lehigh.edu

I've been asked to help with a possible virus PC infestation at
another institution, in our area. If this virus is confirmed, as far
as I know it would be the first PC virus found in our locale (London,
Ontario, CANADA). MAC viruses have hit our university at least once,
though.  Currently, this virus seems to be restricted to just one PC,
as far as we know, anyway.

The Symptoms:
    (1) When running Fastback-Plus to backup the 20 meg hard disk
        more than 100 floppies were needed

    (2) A second directory named CS was found on the hard disk. It had
        never knowingly been setup by the user. It contents seemed
        to reference files referenced in other directories.

    (3) When this CS directory was removed - none of the files it
        had referenced could be accessed even though they were still
        in existing directories.


Some thoughts:

    (1) Some people have suggested that Norton Utilities might setup
        a second directory to protect the hard disk. The Norton Utilities
        are on the hard disk but the user doesn't think this feature
        (if it exists) was ever activated.

    (2) The makers of Fastback Plus were contacted and have said that
        their product does not create any "mirror-image-like" directory.

Some questions:

    (1) I'm aware of virus-protection software like FLU-SHOT+
        and CHECKUP for PCs. Is there any virus-detection and
        identification software for PCs? Something we could
        use to isolate, identify and remove the virus, we are facing.

    (2) Has anyone seen a virus like this? If you have, what is it
        and how do you get rid of it.

    (3) Is there some other explanation for the symptoms? ie. - we
        don't really have a virus?

Thanks in advance for your help.

 ********************************* David W. Loveless
 *  Today's Question...          * Technical Support Analyst
 *                               * The University of Western Ontario
 *  How do I know what virus I   * Computing and Communications Services
 *  have? Is there a cure?       * Administrative Systems Support
 *                               * Room #16, Stevenson-Lawson Building
 ********************************* London, Ontario
 E-Mail:                           CANADA N6A 5B8
      CCSDWL@UWOCC1.UWO.CA         PHONE: (519) 661-2111  EXT: 5993