Path: utzoo!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: XPUM04@prime-a.central-services.umist.ac.uk (Anthony Appleyard)
Newsgroups: comp.virus
Subject: Re: Weird Stuff Happening to Pc's Here At Ohio Univ. (PC)
Message-ID: <0004.9103081913.AA10967@ubu.cert.sei.cmu.edu>
Date: 7 Mar 91 11:34:16 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 21
Approved: krvw@sei.cmu.edu

from: {A.Appleyard} (email: APPLEYARD@UK.AC.UMIST), Thu, 07 Mar 91 11:19:20 GMT
On 05 Mar 91 20:29:08 +0000 smash@oucsace.cs.ohiou.edu (Scott Mash) wrote:
(1) "....Most of the computers will not recognize  the  printers.  We  have
tried  everything short of formating the hard drive and rebuilding it.... "
(2) "....Last week one of our lab guardians  came  up  to  the  office  and
reported  that  he  scanned someone's disk and found a virus called "ohio".
When he tried to clean it V72 couldn't recognize or clean it....".
.......................................
There may or may not be a connection between these two events. There  is  a
PC  virus  called 'Ohio' which has been known of for quite a time. It could
be that why Version 72 (of which  antiviral  please?)  found  it  and  then
couldn't  clean it, is that a file on that PC contained an innocent program
containing a section of code that accidentally duplicated the part  of  the
Ohio virus used as a search signature. That sort of thing happens from time
to time, e.g. these messages in Virus-L vol4:-                        ISSUE
["Virus" story] hard disk crash?;
  antiviral thought that TOPS network software was a virus (longish)    025
[SCANv74B false positive (PC)] thought that KILLER.COM (a small Stoned
  remover) had/was Invader virus                                        032
F-FCHK with [New Leprosy signiture? (PC)] thought that Turbo Debugger 1.0
  TD.OVL & Turbo C++ 1.0 TCLASSS.LIB had or were Leprosy virus          025