Path: utzoo!censor!geac!torsqnt!lethe!yunexus!ists!helios.physics.utoronto.ca!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!apple!julius.cs.uiuc.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: re: obscure procedure in Yankee Doodle (PC)
Message-ID: <0014.9101111559.AA00331@ubu.cert.sei.cmu.edu>
Date: 11 Jan 91 14:39:54 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 17
Approved: krvw@sei.cmu.edu

Martin Zejma <8326442@AWIWUW11.BITNET>:
> Are there systems where this part of memory is accessible or would the
> virus just overwrite a resident other virus when the value in the
> BIOS-segment is below 280h due to a previous (already running)
> infection ?

I haven't verified it myself, but a reasonably authoritative rumor
says that the checksum the virus does will detect a Bouncing Ball
(a.k.a. "Ping Pong") infection active in memory, and patch it so that
it (eventually?) stops infecting.

There are a few other cases of viruses that look for other viruses;
the Den Zuk / Ohio family look for and remove the Brain (before
installing themselves), the TPxxVIR look for and remove earlier
members of the family, and so on.

DC