Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!cs.utexas.edu!sdd.hp.com!uakari.primate.wisc.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: RADAI@HUJIVMS.BITNET (Y. Radai)
Newsgroups: comp.virus
Subject: Re: Disk Killer bug (PC)
Message-ID: <0016.9008221137.AA19228@ubu.cert.sei.cmu.edu>
Date: 21 Aug 90 15:47:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 21
Approved: krvw@sei.cmu.edu

David Chess writes:

>The Disk Killer virus has a bug (at least one) that causes it to
>sometime/often/usually mark the wrong sectors as bad in the FAT when
>it infects a diskette.  ....  Does
>anyone know in any detail under what circumstances the bug shows up?
>From some limited testing, it looks as though the wrong sectors are
>marked bad if a freshly- formatted diskette is used in a machine with
>the virus in memory, but the right sectors are marked bad if the
>diskette already has considerable stuff on it when it becomes
>infected.  Does this sound right to others who have looked at it?

Yes, the August issue of the Virus Bulletin has an article which comes
to the same conclusion: "If a completely blank floppy disk is infected
with the virus, an uninitialised counter in the routine which searches
through the FAT for free clusters will cause the wrong 3 clusters to
be labelled as bad."

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET