Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!usc!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: re: VIRSCAN Question (PC)
Message-ID: <0006.9105211425.AA07798@ubu.cert.sei.cmu.edu>
Date: 20 May 91 18:44:04 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 20
Approved: krvw@sei.cmu.edu

> From:    "Robert McClenon" <76476.337@CompuServe.COM>
>
>                   The scan resulted an error message being displayed
>three times saying something to the effect of: An invalid opcode was
>encountered without an error handler being registered.  This message
>did not say where the error was found.

Heh!  That error message is coming from the FAPI interface code in
VIRSCAN.EXE.  (VIRSCAN is a "Family Application" that can run under
either OS/2 or DOS.)  The only time I've seen it before is when
something has damaged the VIRSCAN.EXE file (and damaged it enough that
it bombs before it gets to the self-check).  Could this VIRSCAN.EXE
have been damaged by something?  Some viruses, the 1813 (Jerusalem)
for example, have bugs that keep them from correctly infecting Family
Apps, and they sometimes break them instead.  I'd suggest that your
friend get a known-good copy of VIRSCAN.EXE, and run it from a
write-protected floppy.  That's the best advice I can think of at the
moment...

DC