Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!gem.mps.ohio-state.edu!usc!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: David.M..Chess.CHESS@YKTVMV
Newsgroups: comp.virus
Subject: re: The DataCrime viruses (PC)
Message-ID: <0002.8910062006.AA22699@ge.sei.cmu.edu>
Date: 5 Oct 89 00:00:00 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 24
Approved: krvw@sei.cmu.edu

> DC-2 does it on any day
> between Jan 1 and Oct 12, except on Sundays!

That's not true for the sample that I've seen.  I suspect someone's
just misreading the code (it's easy to do; that area is rather
convoluted).  It could be a new variant, of course, but if it really
*did* do its damage between Jan 1 and Oct 12, wouldn't it have
basically Gone Off by now?  I think your source is just misinformed.
There does seem to be a day-of-the-week check in there, but I'm not
sure what it does at the moment (not damaging on Sundays is possible,
but I wouldn't want to promise anyone!).

In summary, the important differences that I know of between the
DataCrime (1168 and 1280 strains) and the DataCrime II are that
the II:
  - Makes COM files 1514 bytes longer when it infects them
  - Also infects EXE files
  - Stores itself garbled on disk (except for the degarbler)
  - Has a slightly different message ("* DATACRIME II VIRUS *")

Otherwise, it's the same beast, with the same damage conditions.
Of course there may be more variants that I haven't seen!

DC