Path: utzoo!attcan!uunet!mailrus!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: dsndata!tssi!nolan@uunet.UU.NET Newsgroups: comp.virus Subject: Jerusalem B (PC) reinfection despite using VSHIELD? Message-ID: <0002.9009251406.AA22228@ubu.cert.sei.cmu.edu> Date: 24 Sep 90 22:20:05 GMT Sender: Virus Discussion List Lines: 25 Approved: krvw@sei.cmu.edu Last week I discovered the Jerusalem B virus on one of our PCs. It had only infected 7 files (around 30 times). I had run SCAN on that system on Aug 13th, so it arrived after that. I didn't find it on either of the other PC's, eliminated it from the infected system, and installed VSHIELD on all three PCs. The following afternoon, my assistant copied SCAN and CLEAN to a diskette that had previously been used only for transferring data files between PCs. After the 'copy' commands were done, he SCANned the diskette, and it had Jerusalem B on it. The copy was done from a system supposedly protected with VSHIELD. The system from which the copies were made is clean, according to SCAN. Can Jerusalem B infect data files, or is there something else on a 3 1/2 inch floppy that can contain Jerusalem B? At this point, the infected diskette contains only the 4 files that were copied to it last Thursday. - ------------------------------------------------------------------------------ Mike Nolan "To err is human, to forgive Tailored Software Services, Inc. is divine, to procrastinate is, Lincoln, Nebraska (402) 423-1490 um, can I get back to you on that?" UUCP: tssi!nolan (feed site changed, dsndata!tssi!nolan might be better) INTERNET: nolan@pythia.unl.edu (only if the other address doesn't work)