Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!apple!sun-barr!lll-winken!lll-lcc!rzh
From: rzh@lll-lcc.UUCP (Roger Hanscom)
Newsgroups: comp.sys.ibm.pc
Subject: Re:  The Columbus Day Virus
Keywords: virus, infection, busy
Message-ID: <2604@lll-lcc.UUCP>
Date: 20 Sep 89 16:37:23 GMT
Organization: Lawrence Livermore Labs, LCC, Livermore Ca
Lines: 28


In <412@castle.ed.ac.uk> erck12@castle.ed.ac.uk (Gnome) writes:

>In article <0000@starsend.UUPC> floyd@starsend.UUCP writes:
>-An article in the September 11th issue of Info-World warns of a DOS virus
>-which is supposed to be triggered on Oct. 12 and destroy hard disk track 0.
>-It is has been called, "Datacrime 89", A.K.A "The Columbus Day Virus",
>-A.K.A. "The Icelandic Virus."
>
>	Could someone post to tell the world how to detect this virus. I think
>there is considerable interest!
>
>-- 
>
> Geoff Ballinger,                    JANET: Geoff@Ed.Ac.Uk
> CS/AI,                               ARPA: Geoff%Uk.Ac.Ed@nsfnet-relay.Ac.Uk
> Edinburgh University.                UUCP: ...!uunet!mcvax!ukc!Ed.Ac.Uk!Geoff

I have no direct knowledge of this virus, but I can pass along some comments
that were made by my employer about it.  It apparently attaches to any .COM
file *except* COMMAND.COM.  To detect it, compare the size of .COM files on
your system to those on the distribution diskettes.  An infected .COM should
be 1168 or 1280 bytes larger.  Obviously, all .COM files should be examined
in order to completely eradicate it, including those on backups.  That should
keep those of you with high capacity hard disks busy until at least Columbus
Day.   1/2  @:^)
                 roger             rzh@lll-lcc.llnl.gov