Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: Disk Killer bug (PC)
Message-ID: <0015.9008101840.AA07688@ubu.cert.sei.cmu.edu>
Date: 9 Aug 90 18:54:08 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 14
Approved: krvw@sei.cmu.edu

The Disk Killer virus has a bug (at least one) that causes it to
sometime/often/usually mark the wrong sectors as bad in the FAT when
it infects a diskette.  If the diskette is later written to, this
often results in the virus's on-disk code being overlayed, rendering
the diskette non-bootable and non-infectious (although the boot sector
is still there, so scanners will still see it as infected).  Does
anyone know in any detail under what circumstances the bug shows up?
From some limited testing, it looks as though the wrong sectors are
marked bad if a freshly- formatted diskette is used in a machine with
the virus in memory, but the right sectors are marked bad if the
diskette already has considerable stuff on it when it becomes
infected.  Does this sound right to others who have looked at it?

DC