Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!sdd.hp.com!elroy.jpl.nasa.gov!usc!trwind!venice!bien
From: bien@venice.SEDD.TRW.COM (Frank E. Bien)
Newsgroups: comp.windows.ms
Subject: Re: Possible Virus in cica.cica.indiana.edu
Summary: Also had unmovable block problems
Message-ID: <886@venice.SEDD.TRW.COM>
Date: 1 Nov 90 23:24:22 GMT
References: <1990Oct30.200205.1245@cunixf.cc.columbia.edu>
Reply-To: bien@venice.sedd.trw.com (Frank E. Bien)
Organization: TRW Systems Engineering & Development Division, Redondo Beach, CA
Lines: 31

In article <1990Oct30.200205.1245@cunixf.cc.columbia.edu> jpl5@cunixb.cc.columbia.edu (Jay P Lessler) writes:
>
>After reading the message here about a possible virus in cursor.zip (The file
> that changes the mouse pointer, from cica) I checked my hard disk with
> Norton Utilities' Speed Disk.  It seems that some program has been allocating
> blocks as unmovable.  Since everything that I run is also being run on my
> friend's pc, except cursor.zip, I believe curse.exe contains a virus.  Can
> anyone else who has run curse.exe check for extra unmovable blocks?  If you
> have definitive proof that curse.exe contains a virus, please e-mail me the
> name of the virus so that I can kill it.
>
>Thanks
>--Jay Lessler


I also installed CURSE.EXE on my machine.  I had   _a lot_ of promblems
with it.  It does wipe out your load= WIN.INI command.

I also checked my disk w/norton 5.0. . .  I noticed blocks marked as
unmovable which normally should not be (ZIPPER.EXE on others).
I don't know if CURSE.EXE had anything to do with it, but I also
had the problem.  It may be premature to say CURSE is a trojan or
has a virus. . . but I threw mine away anyway.  Only time will tell
what will happen.  I haven't seen anything more on the subject in 
COMP.VIRUS, but I'll keep looking.
  
Frank E. Bien
TRW Computer Security Services
bien@venice.sedd.trw.com