Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: frisk@RHI.HI.IS (Fridrik Skulason)
Newsgroups: comp.virus
Subject: (Possibly) a new COMMAND.COM virus (PC)
Message-ID: <0007.8907201152.AA01476@ge.sei.cmu.edu>
Date: 19 Jul 89 23:11:29 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 25
Approved: krvw@sei.cmu.edu

Yesterday I went to check out a reported virus infection in a large
company here.

The main symptom was that COMMAND.COM would grow by approx. 400 bytes,
when it was infected. The virus was a bit similar to the original
"Jerusalem" virus in one respect - it was unable to recognize existing
infections and the file would just grow and grow (which caused it to
be noticed).

When I arrived, they were very proud that they had just "wiped out" the
infection.

They did not reformat every single hard disk, as one site here that got
infected by the Ping-Pong virus just did, but they wiped out every copy
of COMMAND.COM using WIPEFILE, and then restored them from the original
floppies.

So - I was unable to obtain a sample.

Since the description does not fit any virus that I know of, I would like
to ask everybody if they have heard of this virus, which (just possibly)
arrived with a number of illegal copies of software from Hong-Kong.

If I obtain a sample or more information, I will post a full description
on VIRUS-L.