Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sun-barr!apple!usc!julius.cs.uiuc.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: N7FRJ@locke.hs.washington.edu Newsgroups: comp.virus Subject: Strange Behavious (Virus?) On Novell LAN Message-ID: <0009.9011081829.AA17940@ubu.cert.sei.cmu.edu> Date: 8 Nov 90 04:18:00 GMT Sender: Virus Discussion List Lines: 23 Approved: krvw@sei.cmu.edu XT and AT class PC's running MS-WORD version 5.0B on an Advanced Netware 286 Version 2.15c LAN in Seattle have either 'crashed' while attempting to save the document they were working on, or have received a message saying: "You SHOULDn't print this file" when they attempt to print it... This started on 1-Nov-90, (I noticed thhalloween notice a couple days back) and thought i would report this as well. Other known symptoms so far have been: At least 2 unrelated executable files have been 'altered'. Unfortunately, several users had SUPERVISOR priv's. The executable file MENUPARZ.EXE (in the PUBLIC directory) had several chunks of it 'zeroed'. It's date and size were not changed, only it's contents. It was flagged as ROS. (But with SUPERVISOR priv's, you can do anything, right?) I was contacted in an attempt to 'quantify' what was going on. All comments are appreciated! George Saba N7FRJ @ Locke.hs.washington.edu N7FRJ @ UWALOCKE (BitNET)