Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: ddavidso@mqccsunc.mqcc.mq.OZ.AU (Dean Davidson)
Newsgroups: comp.virus
Subject: new virus 1022 (PC)
Message-ID: <0004.9007091826.AA07309@ubu.cert.sei.cmu.edu>
Date: 2 Jul 90 16:28:02 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 48
Approved: krvw@sei.cmu.edu

New Virus "1022"

One of our networks has been infected by a virus.
It is not detectable by SCAN V63.

Symptoms:
Only infects .EXE files, adding 1022 bytes to them
Infects files even if they are r/o
Changes the date on the files it infects to the current system date.
It appears that after running the first infected .EXE it starts
up a TSR that carries out further infection

Detection:
running STRINGS on an infected file reveals :

This message is dedicated to  $
all fellow PC users on Earth  $
  Towards A Better Tomorrow   $
And A Better Place To Live In $
 03/03/90 KV KL MAL

[There is no CR/LF after the $ character - I added this
so that the message is readable]

Also detection might be done by looking at the date/time change
on the infected files

To scan all your files (until a version of SCAN is produced which
   detects this virus):
GREP -d+ dedicated *.EXE
[The GREP I used is the one that comes with Turbo Pascal]
[I chose "dedicated" for the search string as it is the most
 unique word in the message]

Damage:
Unknown at this stage

Removal :
Restore the .EXE from backup

Dean Davidson
Microcomputer Support
Office of Computing Services
Macquarie University
NSW 2109
Australia

61 2 805 7436