Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: glenn@sirius.econ.uga.edu (Glenn F. Leavell)
Newsgroups: comp.virus
Subject: Re: Possible virus? (PC)
Message-ID: <0002.9008141517.AA11481@ubu.cert.sei.cmu.edu>
Date: 13 Aug 90 20:55:23 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 48
Approved: krvw@sei.cmu.edu

In Virus-L V3 #141,  Tulshi Saha writes:

>Recently when I turned on my portable (AT compatable) computer, it was
>giving BIOS error. Since I know a little about computer, I reformatted
>the hard drive and installed dos. Now, machine is booting from
>harddrive. Since, I am suspicious about viruses, I used "Scan" (by
>McAfee) program but it could not detect any viruses in the memory.
>Another program VACINE also could not detect any thing in IBMBIO.COM
>and IBMDOS.COM.

This indicates that there is a very strong chance that no virus exists on
your hard drive.

>Then I used FLU_SHOT+ program (using FCP command). It
>giving me the following messesages:
>                 Bad Checksum on C:\COMMAND.COM
>                 Actual Checksum is 44717
>                 (Press any key to continue)
>                 Bad Checksum on C:\IBMBIO.COM
>                 Actual Checksum is 02147
>                 Bad Checksum on C:\IBMDOS.COM
>                 Actual Checksum is 54378
>                 (Press any key to continue)

If you don't give FLU_SHOT+ the correct checksums when you install it,
you will get these errors.  As a matter of fact, this is how you first
determine what the correct checksums are.

>Again I tried the SCANRES program from SCAN which give me now the
>following messages:
>           ? Warning! TSR request from an unregistered program!
>           Number of paragraphs of memory (in decimal) are : 01258
>I would appreciate if any one can help me to find out how to disinfect
>this.  Thank you for your kind attention.

Now that FLUSHOT+ is running TSR in your system, it will report any
TSR requests that are unregistered.  It seems that you have not
registered SCANRES, so when you tried to run it, you got this error.

I hope this helps,
Glenn Leavell
+---------------------------------------------------------------------------+
| Glenn F. Leavell                     | Internet: glenn@rigel.econ.uga.edu |
| Systems Administrator                | Phone: 404-542-3488                |
| Economics Department                 |------------------------------------|
| University of Georgia                |                                    |
| Athens, GA  30602                    |                                    |
+---------------------------------------------------------------------------+