Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!iuvax!ux1.cso.uiuc.edu!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: RREINER%YORKVM1.BITNET@VMA.CC.CMU.EDU Newsgroups: comp.virus Subject: Disk Killer in Montreal (followup) Message-ID: <0010.8910231421.AA08239@ge.sei.cmu.edu> Date: 21 Oct 89 04:41:30 GMT Sender: Virus Discussion List Lines: 15 Approved: krvw@sei.cmu.edu I have now confirmed that the virus I reported in VALERT-L this morning is indeed Disk Killer. The boot sector signature, and the message texts stored elsewhere on the disk, match those reported in VIRUS-L on 26 September by Alan Roberts. There is one discrepancy: while Alan reports that the message texts are stored at sector 152 (presumably decimal) on floppy disks, on the infected disks in my possession they are at sector 354 decimal (0x162). This may therefore be a new strain. I have not yet been able to trace the source of the infection; I will post again if I succeed. Richard J. Reiner . BITNET ...... rreiner@vm1.yorku.ca ..... (daily) .. .................... old BITNET .. rreiner@yorkvm1 .......... (daily) .. .................... Internet .... grad3077@writer.yorku.ca . (daily) .. .................... Compu$erve .. 73457,3257 ............... (rarely) .