Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!think.com!snorkelwacker.mit.edu!bloom-beacon!eru!hagbard!sunic!news.funet.fi!cc.tut.fi!public
From: public@cc.tut.fi (PD Software Group)
Newsgroups: comp.sys.ibm.pc.misc
Subject: Re: "Yankee Doodle virus"
Keywords: virus
Message-ID: <1991May3.095321.28897@cc.tut.fi>
Date: 3 May 91 09:53:21 GMT
References: <673197135@mars.cs.duke.edu>
Organization: Tampere University of Technology, Finland
Lines: 25


In article <673197135@mars.cs.duke.edu> lhb@duke.cs.duke.edu (Pete Boyd) writes:
>Recently we learned that a PC on campus had been infected with 
>the "Yankee Doodle" virus. The PC was scanned with the
>McAfee Associate's virus detection software and was confirmed
>to be infected.
>...
>Question? How is the Yankee Doodle virus transmitted? Should I
>          look for other symptoms?

Yankee Doodle gets in memory when infected file is executed. After
that it will infect every .COM and .EXE file that is executed. There
are many versions of Yankee Doodle (48 different variants - the first
ones are usually identified as Vacsina and the newer ones as Yankee
Doodle). Some Yankee Doodles play their tune (yankee doodle dandy)
when system clock is 5.00pm, some YDs play it when ctrl-alt-del is
pressed, some play it when infection happens... There are more
information about that virus (and about many other viruses) in the
Patricia Hoffman's Virus summary. It is available on many anonymous
FTP sites - the newest version of it is named VSUM9104.ZIP.

-- 
Tapio Keih{nen         | "Whenever you dream
Mesihein{nkatu 2 B 6   | you're holding the key,
33340 Tampere, Finland | it opens the door
public@cc.tut.fi       | to let you be free" - RJD '85