Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!tut.cis.ohio-state.edu!gem.mps.ohio-state.edu!apple!bionet!sdsu!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: jr@ncrsecp.Copenhagen.NCR.dk (Jakob Riis) Newsgroups: comp.virus Subject: Re: The DataCrime viruses (PC) Message-ID: <0012.8910241138.AA15306@ge.sei.cmu.edu> Date: 24 Oct 89 09:13:11 GMT Sender: Virus Discussion List Lines: 26 Approved: krvw@sei.cmu.edu In article <0002.8910062006.AA22699@ge.sei.cmu.edu> David.M..Chess.CHESS@YKTVMV writes: >> DC-2 does it on any day >> between Jan 1 and Oct 12, except on Sundays! >That's not true for the sample that I've seen. I suspect someone's >just misreading the code (it's easy to do; that area is rather >convoluted). It could be a new variant, of course, but if it really >*did* do its damage between Jan 1 and Oct 12, wouldn't it have >basically Gone Off by now? I think your source is just misinformed. You might both be right ! The de-assembled code I've seen shows that its fairly easy to trim DCII to go off anytime you would like it - in fact you can de-arm it yourself by setting the day check equal 8 ! (but I guess I would rather re-install the original programs). If I don't remember wrong the newly dreaded Columbus day Virus was such a re-programming of DCII. Just my 2 cents worth, _____________________________________________________________________________ Jakob Riis | Jakob.Riis@Copenhagen.NCR.dk NCR Corporation | or Systems Engineering Copenhagen | ..!uunet!mcvax!dkuug!ncrsecp!jakob.riis - --------------------------------------------------------------------------- ! A plucked goose doesn't lay golden eggs ! - ---------------------------------------------------------------------------