Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!usc!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: mrh@camcon.co.uk (Mark Hughes) Newsgroups: comp.virus Subject: Re: QEMM Virus? (PC) Message-ID: <0006.9101101857.AA07273@ubu.cert.sei.cmu.edu> Date: 9 Jan 91 09:47:04 GMT Sender: Virus Discussion List Lines: 47 Approved: krvw@sei.cmu.edu rtravsky@CORRAL.UWyo.Edu (Richard W Travsky) writes: >This appeared in a recent Info-Ibmpc digest. Figured I'd pass it on. > ...deleted... >From: David Kirschbaum >Subject: Reported QEMM virus >Received from the Fido Dr. Debug Echo, 1 Jan 91. >David Kirschbaum >Toad Hall >FROM: Richard Crain Area # 23 ( Dr. Debug ) >TO: ALL >SUBJECT: Virus >I have found what appears to be a virus on the factory supplied disk >from Quarterdeck on the QEMM386 V5.1 diskette in the Optimize.com amd >install.exe programs. These 2 programs contain a HEX signature of >EAF0FF00F0 which indicates the possible presence of the 648 virus. I have checked my QEMM v5.0 master disks and find this signature also occurs in the same named files, but which are obviously much older. They are dated 9 March 90 on my disk. I have been using QEMM v5.0 for a good few months (can't remember exactly when I bought it) and have had no reason to suspect virus infection of my system. The age of QEMM v5.0 without apparent virus report is interesting. In addition, McAfee's scan program 5.1v67 fails to complain about QEMM v5.0 or v5.1 despite manual inspection showing that the signature does appear as reported above. A "Vienna/648" virus is described in the McAfee documentation. This is all fairly re-assuring to me, but it is possible that this is a dormant virus just waking up. It needs further investigate (by Quarterdeck I guess), but caution rather than panic seems appropriate. Hope this adds to the investigation. [Ed. Please see followup below!] Mark - -- ---------------- Eml: mrh@camcon.co.uk or mrh@camcon.uucp | Mark Hughes | Tel: +44 (0) 223 420024 Cambridge Consultants Ltd. |(Compware & CCL)| Fax: +44 (0) 223 423373 The Science Park, Milton Road, ---------------- Tlx: 81481 (CCL G) Cambridge, CB4 2JB, UK.