Path: utzoo!utgpu!watserv1!watmath!att!att!linac!pacific.mps.ohio-state.edu!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: Preston@DOCKMASTER.NCSC.MIL
Newsgroups: comp.virus
Subject: novell question (PC)
Message-ID: <0007.9011011437.AA08158@ubu.cert.sei.cmu.edu>
Date: 31 Oct 90 13:45:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 23
Approved: krvw@sei.cmu.edu

I had a report from someone who has been having trouble with a small
Novell 286 network.  While the problems don't sound to me like any
known executable file virus, perhaps someone has seen similar
symptoms.

The server is not dedicated.  There have been a few file size changes,
to COMMAND.COM, and other files, on the order of 3K in size.  This is
on server files, not workstation files.  Once a message was printed
"The world will hear from me again".  The latest copy of McAfee's Scan
shows nothing, and any copies of the "infected" files do not appear to
have a virus infection after examination by experienced virus people.

Entire directories (Public) and individual programs including the
backup program have been wiped out several times.  User logins have
disappeared.  There may have been unusual .BAT files appearing and
disappearing.  The server has been downed several times.

If anyone has seen any symptoms similar to this recently, please let
me know.

Charles M. Preston          CompuServe 74025,367
Box 240027                  907-344-5164
Anchorage, AK  99524        BIX  cpreston