Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!usc!orion.oac.uci.edu!ucivax!ucla-cs!math.ucla.edu!julia!terry
From: terry@julia.math.ucla.edu (Terence J. McKiernan)
Newsgroups: comp.binaries.ibm.pc.d
Subject: Re: a strange problem with  vi editor
Message-ID: <473@kaos.MATH.UCLA.EDU>
Date: 2 Oct 90 20:46:42 GMT
References: <149@inews.intel.com> <5s8Dq2w163w@micasa.UUCP>
Sender: news@MATH.UCLA.EDU
Reply-To: terry@math.ucla.edu (Terence J. McKiernan)
Organization: UCLA Mathematics Department
Lines: 51

In article <5s8Dq2w163w@micasa.UUCP> jzl@micasa.UUCP (Jack Z. Lupic) writes:
>ahegde@mipos2.intel.com writes:
>
>> 
>> 	Hello there,
>> 			i have a public domain `vi` editor for PC and it
>> 	gives the following logo when invoked :
>> 
>> 	-------------------
>> 	by Jim Goodnow II
>> 	version 1.2
>> 	7/11/85
>> 
>> 	(c) 1984, 85 Manx Software Systems, Inc.
>> 	--------------------
>> 
>> 	There is a peculiar problem with this program. Its original size
>> 	should be around 25-30K (it is a .exe file). Every time this
>> 	program is invoked, ITS SIZE INCREASES BY exactly 1808 bytes.
>
>Maybe it's has a virus in it.Try scanning it with SCAN.EXE from McAfee
>and let us know what it tells you.
>
>
>Jack Lupic

STOP!  TURN OFF YOUR MACHINE!

er, sorry for the panic ...

I will bet very large odds your PC is infected with the Jerusalem B virus,
or one of its kin.  JB modifies executables so that they increase in
size with successive infections, generally by 1808 bytes (though I've
seen 1807 and 1820 as well).

If vi is increasing in size each time you run it, then JB is resident in
your computer's memory.  As suggested by Jack Lupic, McAfee Associates'
SCAN program is a sure way to detect this virus.  However, you should 
turn off your PC first, since while the virus remains in memory, it 
will infect every program you run.  Turning the machine off and on 
will wipe it from memory.  Boot from an original, WRITE-PROTECTED 
DOS disk.  Also, check any diskettes that have been in and out of your
floppy drives recently.

McAfee Associates make several virus detection and removal programs, 
see the documentation provided with the programs.  They're available
on simtel 20 and wuarchive.

I am not affiliated, etc., etc., except as a satisfied customer.

>>> terry <<<