Path: utzoo!attcan!uunet!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: Alan_J_Roberts@cup.portal.com Newsgroups: comp.virus Subject: New Boot Sector Virus (PC) Message-ID: <0010.9007301317.AA00380@ubu.cert.sei.cmu.edu> Date: 29 Jul 90 19:49:40 GMT Sender: Virus Discussion List Lines: 39 Approved: krvw@sei.cmu.edu This is a forward from Aryeh Goretsky of the Computer Virus Industry Association: ================================================================ John McAfee has authorized me to begin posting selected CVIA Membership Alerts to VIRUS-L/VALERT-L. Ken van Wyk has asked John if he would provide more information to VIRUS-L subscribers about infection occurences by new virus strains. Membership Alerts appear to be the best way to do this. All Alerts will be posted to Virus-l provided the report originator does not specify membership restricted distribution. Accordingly, the following Alert is submitted: July 27, 1990 CVIA Membership Alert Originating Member: Microsoft Corporation Alert Type: New Virus in Public Domain Library Entry: AIRCOP Entry Type: Boot Sector Virus CVIA member Microsoft Corporation has reported a public domain U.S. infection by a new boot sector virus. The virus has been submitted to the library and is currently under analysis. The virus replicates in the normal boot sector fashion by booting from an infected floppy. Non-write-protected diskettes that are inserted into an infected system become infected at the time that the diskette is first referenced. The virus randomly displays the following message: Red State, Germ Offensive. AIRCOP Potential data damage has not yet been determined. Early analysis, however, indicates some small similarity to both the Joshi and Marti Brothers boot viruses that have been reported at multiple sites in the U.S. A detector will be made available to liaison staff on Monday, July 30. John McAfee