Path: utzoo!yunexus!lethe!torsqnt!jarvis.csri.toronto.edu!mailrus!wuarchive!udel!haven!mimsy!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: RY15%DKAUNI11.BITNET@IBM1.CC.Lehigh.Edu (Christoph Fischer)
Newsgroups: comp.virus
Subject: VACSINA infects more than EXE and COM files (PC)
Message-ID: <0003.8911161543.AA03334@ge.sei.cmu.edu>
Date: 13 Nov 89 18:41:09 GMT
Article-I.D.: ge.0003.8911161543.AA03334
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 16
Approved: krvw@sei.cmu.edu

Hi,
VACSINA infects any file that is loaded and executed via the INT 21H(4BH)
function. So additionally to COM and EXE files other files like OVL or
APP are infected as long as they start with E9H (jump) or 'MZ' (EXE header).
We have written a program that detects VACSINA and removes it from those
files. Also we have an immuniser that prevents VACSINA from installing its
memory resident copy.

Christoph and Torsten

*****************************************************************
* Torsten Boerstler and Christoph Fischer and Rainer Stober     *
* Micro-BIT Virus Team / University of Karlsruhe / West-Germany *
* D-7500 Karlsruhe 1, Zirkel 2, Tel.: (0)721-608-4041 or 2067   *
* E-Mail: RY15 at DKAUNI11.BITNET or RY12 at DKAUNI11.BITNET    *
*****************************************************************