Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!wuarchive!uwm.edu!ux1.cso.uiuc.edu!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: USERQU0M@SFU.BITNET (Pseudo Dragon)
Newsgroups: comp.virus
Subject: DIR EXEC revisited... (VM/CMS)
Message-ID: <0013.8911281214.AA07608@ge.sei.cmu.edu>
Date: 28 Nov 89 02:04:00 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 25
Approved: krvw@sei.cmu.edu

Apparently, the DIR EXEC everyone has been receiving is rather nasty.
Not only does it send itself to everyone in the files NAMES and NETLOG,
but also:
>The DIR EXEC asks for the system date (QUERY TIME) and erases all files
>if the system date is greater then 89, i.e. next year.

The advice given was:
>Please discard all copies of DIR EXEC in your system RDR queue.
(Quotes from: Joachim Lohoff-Werner)

I'd recommend editing this EXEC so that the spreading and damage part
is removed *completely*, make it read-only, and use it.  After all, it
*does* perform a useful function!  The only problem lies in getting a
bad copy again.  You'd be deleting your own files and starting another
outbreak!

So, once you've gotten it, *then* delete any more incoming (*bad*)
copies.  Just make @#$% sure your copy isn't going to erase your files
in 1990, or spread.

************ From the desktop computer of Charles Howes, USERQU0M@SFU.BITNET
***** Mind you, I'm not using VMS myself.  These *are* only opinions.
***** Simon Fraser University, Vancouver, BC
***** "Unix is like sex; those who haven't tried it don't know what all the
*****  fuss is about; those who have, can't live without it."


Brought to you by Super Global Mega Corp .com