Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!wuarchive!gem.mps.ohio-state.edu!ginosko!uunet!mcsun!hafro!isgate!krafla!frisk
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.sys.ibm.pc
Subject: Re: Possible DOS Virus (?)
Message-ID: <1128@krafla.rhi.hi.is>
Date: 18 Sep 89 11:31:25 GMT
References: <0000@starsend.UUPC>
Reply-To: frisk@rhi.hi.is (Fridrik Skulason)
Organization: University of Iceland (RHI)
Lines: 51

In article <0000@starsend.UUPC> floyd@starsend.UUCP writes:
>An article in the September 11th issue of Info-World warns of a DOS virus
>which is supposed to be triggered on Oct. 12 and destroy hard disk track 0.
>It is has been called, "Datacrime 89", A.K.A "The Columbus Day Virus",
>A.K.A. "The Icelandic Virus."

A few corrections:

	1) This virus will NOT attack on Oct. 12. The activation date is
	   Oct. 13.  The relevant part of the virus looks as follows:

		MOV	AX,startdate	; AX = OCT. 12
		CMP	AX,current	; compare to current date
		JL	Destroy		; if Oct 12. < current, format disk
		JMP	Infect		; Else infect program

	   Note that keeping your computer turned off on Oct 13. will not
	   protect you in any way - the virus will format the start of
	   drive C: the first time an infected program is run ANYTIME AFTER
	   OCT. 12. 
	   
		
	2) This virus has NOTHING what so ever to do with the Icelandic
	   virus. That virus has no specific activation date.

	3) This virus exists in two different versions, called "1168"
	   and "1280". 

>It is reported to propogate itself by attaching to .COM files (COMMAND.COM
>is supoosed to be immune).

Any .COM file where the seventh letter in the name is "D" is immune.

>
>Has anyone discovered this beasty on their system?
>

This virus is VERY rare. In fact, it is almost only known in Europe, and
has only been reported at 50 sites or so. It is NOT a serious threat in the
USA, at least not compared to the other two or three viruses that will
attack on the same date.

Programs to detect/remove this virus (and the other 20 viruses or so) are
available.

See comp.virus for more information on this (and other viruses).
-- 
         Fridrik Skulason          University of Iceland
         frisk@rhi.hi.is           

          Guvf yvar vagragvbanyyl yrsg oynax .................