Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: new boot sector virus (PC)
Message-ID: <0009.9012041821.AA14135@ubu.cert.sei.cmu.edu>
Date: 3 Dec 90 14:30:21 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 29
Approved: krvw@sei.cmu.edu

CCMH@MVS.MCGILL.CA (Michael Head) writes:
>We have found an unknown boot sector virus on "COMBASE" and
>"SVGA-UTILITY" software shipped in PACKARD-BELL PACKMATE-III and 386sx
>computers . The diskettes are in sealed envelopes.  The seal bears
>characters which appear to be chinese .

The diskettes are probably from Taiwan - a country which is
practically flooded by viruses - a friend of mine ordered a machine
from a company there and received it infected with three different
viruses.

Also, every company in Iceland which imports machines from Taiwan, has
at least once received infected machines or floppies.

> Now for the bad news. SCANV67c does not report anything. F-PROT113
>also doesn't find a known virus but reports the boot sector is an
>unusual DOS boot sector and there may be a an unknown virus. (Thanks
>Fridrik,it sure is lonely trying to convince yourself your the first
>one to ever see a brand new virus).

Well, I am glad the routine I added in version 1.13 to analyze boot
sectors for suspicious code turned out to be useful - I am working on
improvements for version 1.14

- -frisk

Fridrik Skulason      University of Iceland  |
Technical Editor of the Virus Bulletin (UK)  |  Reserved for future expansion
E-Mail: frisk@rhi.hi.is    Fax: 354-1-28801  |


Brought to you by Super Global Mega Corp .com