Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!swrinde!cs.utexas.edu!asuvax!ukma!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Whale virus, can anybody find it? (PC)
Message-ID: <0005.9104031509.AA05149@ubu.cert.sei.cmu.edu>
Date: 2 Apr 91 10:59:23 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 13
Approved: krvw@sei.cmu.edu

csw76@seq1.keele.ac.uk (J.C. Kohler) writes:
>I have a computer which is infected by the Whale virus, but none of
>the virus-scanners I use can find it. I found the virus on the
>computer about a week ago, using McAffee's scan. I removed the
>infected files, but it keeps coming up.

Ono possible explanation might be that most existing scanners only
detect the "standard" 30 forms of the Whale, but recently some new
forms have appeared.  There are rumors they are created by a
"configuration" program which swaps out entire modules, if it finds
Whale present in memory, but this has not been confirmed.

- -frisk