Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Application-specific viruses (PC)
Message-ID: <0008.9009211539.AA17296@ubu.cert.sei.cmu.edu>
Date: 21 Sep 90 11:53:21 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 20
Approved: krvw@sei.cmu.edu

woody@chinacat.Unicom.COM (Woody Baker @ Eagle Signal) writes:
>Secondarily, it seems to me that there is a class of viruses that we
>fortunatly have not seen yet.  Application specific viruses.

Well, we have seen a few - here is a partial list.

Macho/Syslock - looks for "Microsoft" and changes it to "Macrosoft"/"Machosoft"
The (reported only) "SYS" variant of "Den Zuk".
Flip - seems to target an unknown program, perhaps an anti-virus progra,
dBase - corrupts dBase files.
There have been unconfirmed reports of two viruses - "Novell" and "123",
targeted against those products.

There may be a few more - I just don't remember them right now...

- -frisk

Fridrik Skulason      University of Iceland  |
Technical Editor of the Virus Bulletin (UK)  |  Reserved for future expansion
E-Mail: frisk@rhi.hi.is    Fax: 354-1-28801  |