Path: utzoo!utgpu!watserv1!watmath!att!att!linac!pacific.mps.ohio-state.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: CCMH@MVS.MCGILL.CA (Michael Head)
Newsgroups: comp.virus
Subject: new boot sector virus (PC)
Message-ID: <0003.9011281444.AA08768@ubu.cert.sei.cmu.edu>
Date: 27 Nov 90 04:16:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 24
Approved: krvw@sei.cmu.edu

We have found an unknown boot sector virus on "COMBASE" and
"SVGA-UTILITY" software shipped in PACKARD-BELL PACKMATE-III and 386sx
computers . The diskettes are in sealed envelopes.  The seal bears
characters which appear to be chinese .
 The disks were not intended to be booted and will produce the
standard error message "NON-SYSTEM DISK etc." if accidently booted,
however the harddisk if present will have been infected.
 The symptoms are varied. Some infected systems play a few notes with
every DOS command issued . On others there are no notes but there is a
lot of I/O of write protected disks (one has the feeling it is trying
to burn its way onto the disk) . Still others (my quarantined
Taiwanese AT) will not boot at all after being infected.
 Now for the bad news. SCANV67c does not report anything. F-PROT113
also doesn't find a known virus but reports the boot sector is an
unusual DOS boot sector and there may be a an unknown virus. (Thanks
Fridrik,it sure is lonely trying to convince yourself your the first
one to ever see a brand new virus).

       Michael Head
 ______________________________________________________________________
   e:mail - ccmh@mvs.mcgill.ca   |    McGill Computing Center
   bitnet - ccmh@mcgillvs.bitnet |    805 Sherbrooke St. West
   voice  - (514) 398-3707       |    Montreal,Quebec
                                 |    Canada    H3A 2K6