Path: utzoo!news-server.csri.toronto.edu!cs.utexas.edu!usc!snorkelwacker.mit.edu!hsdndev!cmcl2!adm!lhc!nih-csl!helix.nih.gov
From: bert@helix.nih.gov (Bert Tyler)
Newsgroups: comp.windows.ms
Subject: It's Bad, but it's not a virus
Message-ID: <1079@nih-csl.nih.gov>
Date: 14 Mar 91 20:22:47 GMT
Sender: news@nih-csl.nih.gov
Organization: National Institutes of Health, Bethesda
Lines: 22

>1) I downloaded from the cica uploads directory a file called yourway.zip
> ..
>2) tried to run it from windows
> ..
>4) warm-boot pc & reenter win ... looks funny ... try & edit win.ini ... 
>   contents are gone & replaced with:
>	<binary garbage> YourWay Ha Ha Ha! <binary garbage...

I don't mean to be picky, but what you are describing would be what
is referred to as a "trojan horse" program, not a virus.  A trojan
horse is a program that is advertised to perform one function, but
in fact does something else - usually destructively, as in this case.
A virus program is a piece of code that attaches itself to other
programs and spreads itself around that way.  Virus-detection programs
in general aren't going to help you detect programs such as the one
you described above.

(Actually, this terminology difference is only important to me because
I know a lot of mainframe folks who can calmly discuss trojan horses,
time bombs, and their brethren - but who panic and attempt to throw
every PC in their company out the window as soon as they hear the word
"virus".)