Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!tut.cis.ohio-state.edu!cica!ctrsol!ginosko!usc!sdsu!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: prieto@gem.mps.ohio-state.edu (Juan Pablo Prieto-Cox)
Newsgroups: comp.virus
Subject: A new version of nVIR A (mac)
Message-ID: <0003.8910231129.AA06880@ge.sei.cmu.edu>
Date: 7 Oct 89 03:10:03 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 18
Approved: krvw@sei.cmu.edu

It seems that there is a new version of nVIR A, or at least that's
what the program Disinfectant reported. I will try to explain what it
did to my system. Unfortunately before I noticed that it didn't behave
as the well known nVIR A I erradicated it with Disinfectant.  After I
run the infected program (a THINK C program) it changed the type of
the files in the same folder (and folders therein) into a seemingly
random type, taken from another file. That is, if you list the files
by KIND under normal circumstances you would get THINK C as the kind,
but after I run the infected program it changed the type to "vamos.c"
that was just a file in the same folder. Upon further explorations
with ResEdit I found in the Desktop file in the APPL resource a
repetition. With Creator KAHL (as for all THINK C programs) but
Application "vamos.c".  I also found a resource of type =/VIR (for
typographical reasons by =/ I mean the symbol for not equal). Remember
that I had already ran Disinfectant.  Does anyone have a clue? or a
similar problem?

Juan Pablo Prieto-Cox