Path: utzoo!news-server.csri.toronto.edu!rutgers!dimacs.rutgers.edu!seismo!ukma!rex!uflorida!travis!hardy!leoh
From: leoh@hardy.hdw.csd.harris.com (Leo Hinds)
Newsgroups: comp.windows.ms
Subject: ***WARNING*** possible windows virus in the cica uploads directory
Message-ID: <2610@travis.csd.harris.com>
Date: 13 Mar 91 19:16:01 GMT
Sender: news@travis.csd.harris.com
Organization: Harris Computer Systems, Ft. Lauderdale, FL
Lines: 30



Hopefully I am crying wolf, but the following is what happened to me right now:

1) I downloaded from the cica uploads directory a file called yourway.zip

2) tried to run it from windows, It popped up a dialog box saying something 
   about your win.ini file has been modified, and asking where datafiles are 
   kept.  I did not tell it a location but hit the OK button ... result, UAE.

3) I copied win.ini to the location I had "yourway" as the data location (a 
   networked drive) & tried to run it again, this time specifying the complete 
   path where yourway was located & hit the ok button, again UAE ... but his 
   time windows was also hung.

4) warm-boot pc & reenter win ... looks funny ... try & edit win.ini ... 
   contents are gone & replaced with:

	<binary garbage> YourWay Ha Ha Ha! <binary garbage mixed with some 
	text strings>


Is this just a fluke or a "windows virus"? ... the YourWay Ha Ha Ha! leads me 
to believe the latter ... but I am open to suggestions.



leoh@hdw.csd.harris.com         	Leo Hinds       	(305)973-5229
Gfx ... gfx ... :-) whfg orpnhfr V "ebg"grq zl fvtangher svyr lbh guvax V nz n
creireg ?!!!!!!? ... znlor arkg gvzr