Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: N7FRJ@UWALOCKE.BITNET (George.Saba)
Newsgroups: comp.virus
Subject: Weird/Virus behaviour on LAN?
Message-ID: <0016.9011141856.AA23262@ubu.cert.sei.cmu.edu>
Date: 8 Nov 90 04:25:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 35
Approved: krvw@sei.cmu.edu

Resent-From: "Otto.Stolz" <RZOTTO@DKNKURZ1.BITNET>

Dear VIRUS-L subscriber,

I think the following contribution from the Novell LAN Interest Group
<NOVELL at SUVM.BITNET> will be interseting to you, as well.
If you want to comment, please direct your response both to VIRUS-L and
either to the Novell Group or the original sender, George Saba <N7FRJ at
UWALOCKE.BITNET, N7FRJ at Locke.hs.washington.edu>.

Best wishes
             Otto

Forwarded note:

> XT and AT class PC's running MS-WORD version 5.0B on an Advanced Netware
> 286 Version 2.15c LAN in Seattle have either 'crashed' while attempting
> to save the document they were working on, or have received a message
> saying:
>   "You SHOULDn't print this file"
> when they attempt to print it...
> This started on 1-Nov-90, (I noticed the halloween notice a couple days
> back) and thought I would report this as well.
>
> Other known symptoms so far have been:  At least 2 unrelated executable
> files have been 'altered'.  Unfortunately, several users had SUPERVISOR
> priv's.  The executable file MENUPARZ.EXE (in the PUBLIC directory) had
> several chunks of it 'zeroed'.   It's date and size were not changed,
> only it's contents.  It was flagged as ROS.  (But with SUPERVISOR
> priv's, you can do anything, right?)
>
> I was contacted in an attempt to 'quantify' what was going on.
> All comments are appreciated!
>
> George Saba