Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!usc!ucsd!ucbvax!bloom-beacon!eru!hagbard!sunic!news.funet.fi!ousrvr!finou!lk-ap
From: LK-AP@finou.oulu.fi
Newsgroups: comp.windows.ms
Subject: Re;"Curse-virus" orig.article
Message-ID: <90305.084851LK-AP@finou.oulu.fi>
Date: 1 Nov 90 08:48:51 GMT
Sender: daemon@ousrvr.oulu.fi
Organization: University of Oulu, Finland
Lines: 40

Hello again netreaders,

I found orig. text about Curse (was in Comp.virus 12 OCT 90) here it
is. Maybe some virus expert will give us a comment.

So chek the text yourself ...

>Newsgroups: comp.virus

>From: padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson)
>Subject: Windows Trojan ? (MS-DOS)
>Date: 12 Oct 90 14:38:21 GMT

>        Have not had a chance to verify yet but want to pass on a
>warning: Received a file that alledgedly sets the cursor in Windows.
>The file is contained in WINCURS.ZIP and is called CURSE.EXE. It is
>windows aware and will not run under plain DOS except to print a
>message.

>        According to the user, when run under Windows, it modifies the
>LOAD= command in the .INI file so that it is always executed. It is
>said that any information that was in the LOAD= section is trashed.
>
>        Once invoked, files appear to have a copy of the first FAT
>sector written randomly into them. It is said that this affects ANY
>file (executable or data). After a period of time (from the
>description) the FAT is destroyed.

>        I have a copy of the file & as soon as it can be properly
>examined, I will post a full description.
>
>                                        Padgett
-------
    |-------------------------|---------------------------------|
    | Antti Peltonen          | Internet: lk-ap at finou.oulu.fi|
    | University of Oulu      | Bitnet:   lk-ap at finou.bitnet |
    | Computer Services Centre|---------------------------------|
    | Linnanmaa               |   This space for vice taughts   |
    | SF 90570 OULU  FINLAND  |   unintentionally left blank.   |
    |-------------------------|---------------------------------|