Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.csd.uwm.edu!uxc.cso.uiuc.edu!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: IRMSS907%SIVM.BITNET@VMA.CC.CMU.EDU
Newsgroups: comp.virus
Subject: VM Virus Warning (IBM VM/CMS)
Message-ID: <0010.8909072037.AA27892@ge.sei.cmu.edu>
Date: 7 Sep 89 19:40:52 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 26
Approved: krvw@sei.cmu.edu

I got this from the PROFS-L discussion list...Mignon Erixon-Stanford

 *** Forwarding note from KIEFFER --UNCANET  09/06/89 19:48 ***
 Date:     Wed,  6 Sep 89 18:16 PDT

 A computer virus has just appeared in the CERNVM system in the form of
 a set of files which copy themselves to your A-disk when you execute
 the commands RELEASE or DROP.  The mechanism is that there is a modified
 RELEASE EXEC which invokes a module called DVHVIR which copies itself,
 plus other files, to your A-disk. It is sufficient to be linked to a disk
 containing these viruses to be vulnerable to them. Some of the copied files
 pretend to be parts of the directory maintenance system and we do not
 yet know what damage they may cause.
 Please take the following action: look for any of the following files on
 your disks and ERASE them at once

         RELEASE EXEC
         DVHGMN  EXEC
         DVHGKB  EXEC
         DMSXMS  EXEC
         DVHVIR  MODULE

         We are attempting to find the source of this virus and are taking
 other preventative measures.

         User Support