Path: utzoo!attcan!uunet!zaphod.mps.ohio-state.edu!usc!trwind!venice!bien
From: bien@venice.SEDD.TRW.COM (Frank E. Bien)
Newsgroups: comp.windows.ms
Subject: Re: Possible Virus in cica.cica.indiana.edu
Message-ID: <888@venice.SEDD.TRW.COM>
Date: 5 Nov 90 17:28:52 GMT
References: <1990Oct30.200205.1245@cunixf.cc.columbia.edu> <4196@anomaly.sbs.com>
Reply-To: bien@venice.sedd.trw.com (Frank E. Bien)
Organization: TRW Systems Engineering & Development Division, Redondo Beach, CA
Lines: 24

In article <4196@anomaly.sbs.com> mpd@anomaly.sbs.com (Michael P. Deignan) writes:
>
> Posting these cries of "possible virus alert" is utterly irresponsible, in
>light of the fact that you've taken no steps to even determine if a virus
>is present on your system.

Don't be so quick  to condemn. . . 

The suggestion that CURSE was a TROJAN (Not a virus!) first came up
on COMP.VIRUS.  Although writing to the WIN.INI file was mentioned,
the main concern was that the file may destroy the FAT table.  Also
the "unmovable block" problem later came up in this group.  

I don't know if it is a Trojan, but the possibility does exist.  Simply
checking  it with McAffee's scan67 means nothing.  If it is new, McAffee
would not know to flag the problem.  That's why there's always new versions
of SCAN. . . each one looks for newer viruses, etc.   

Maybe this discussion should be moved to COMP.VIRUS. . .

Frank Bien
TRW Computer Security Services
bien@venice.sedd.trw.com