Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: RADAI1%HBUNOS.BITNET@VMA.CC.CMU.EDU (Y. Radai)
Newsgroups: comp.virus
Subject: Origin of the name "Vienna" virus (PC)
Message-ID: <0004.8909121110.AA12875@ge.sei.cmu.edu>
Date: 11 Sep 89 14:55:43 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 27
Approved: krvw@sei.cmu.edu


  Manfred Pfluegl asks:
>Where did the virus "VIENNA" get his name from?? Does anybody know
>the answer?

  Well, the answer is just what one would expect: it was first re-
ported in Vienna!  That was in Dec 1987 (or perhaps slightly earlier).
In April 88 the same virus (or a slight mutation of it) was reported
in Moscow, and in Aug 88 it appeared at a summer camp run by Unesco.
Someone who didn't know of its prior existence in Austria gave it the
name DOS-62, presumably because its method of indicating an already
infected file is to set the seconds field of the time entry of the
file to 62.

  I'd like to add one point that was apparently not mentioned by
anyone who replied to Kim's question about the foulup which occurs on
switching diskettes between an "Abort, Retry ..." message and pressing
of the R(etry).  This bug has apparently been removed in DOS 4 by the
inclusion of a Volume Serial Number which is written into the boot
sector (bytes 27h-2Ah) by FORMAT.  (This is a random number based on
the date and time when FORMAT was performed.)  Before allowing the
operation to be retried, the critical-error handler checks this number
on the diskette.  If it does not match, you get the message "Invalid
disk change".

                                          Y. Radai
                                          Hebrew Univ. of Jerusalem