Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: public@alva.tut.fi (Public Domain PC-software) Newsgroups: comp.virus Subject: New virus (PC) Message-ID: <0015.9101021349.AA03694@ubu.cert.sei.cmu.edu> Date: 21 Dec 90 20:33:35 GMT Sender: Virus Discussion List Lines: 24 Approved: krvw@sei.cmu.edu I've found a new virus on PC at the beginning of December, but it has been around here at least from the end of June. I've named that virus as 2480 virus, because its size is that. 2480 Virus spreads only (I think) if the year is set to 1988 or earlier. If it is later than 1988, infected files will occasionally display the logo of European Crackin' Crew (Does anyone know anything about that group??) when user executes an infected program. 2480 Virus adds 2480 bytes to the end of every .COM file it decides to infect. It doesn't infect files very quickly and it seems that infection happens only at the certain time. It will also change the last modification time to the time when infection happened but the files' dates remain unchanged. 2480 Virus is not memory resident and it can easily be noticed because the European Crackin' Crew's logo is at the end of every infected .COM file. This virus is not detected by the ViruScan V72, but I've sent a copy of it to Mr. John McAfee and Fridrik Skulason, so hopely the ViruScan V73 and F-Prot 1.14 will find this virus :-) Tapio Keihanen Mesiheinankatu 2 B 6 33340 Tampere Finland PS. I'm sorry for my POOR English...