Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!zaphod.mps.ohio-state.edu!mips!atha!lsuc!jimomura
From: jimomura@lsuc.on.ca (Jim Omura)
Newsgroups: comp.sys.atari.st
Subject: Re: ST User Virus!
Message-ID: <1991May29.012148.23506@lsuc.on.ca>
Date: 29 May 91 01:21:48 GMT
References: <1991May24.015422.23817@minyos.xx.rmit.oz.au> <10099@suns2.crosfield.co.uk> <1991May28.202555.16251@lsuc.on.ca>
Distribution: comp
Organization: Consultant, Toronto
Lines: 48

In article <1991May28.202555.16251@lsuc.on.ca> jimomura@lsuc.on.ca (Jim Omura) writes:
>In article <10099@suns2.crosfield.co.uk> imt@crosfield.co.uk (ian taylor) writes:
>>(This is probably only of interest to UK netters, although I believe ST User
>>magazine is available internationally by mail order)
>>
>>Has anyone had problems with this months (June) ST User cover disk?
>>I think that there is a free virus included on the coverdisk, which mangled
>>the directory of two of my disks before I eradicated it. This is the second
>>time that ST User has done this, and frankly I am bloody unimpressed. Anyone
>>who's got this disk, beware.
>
>
>     Having read this message I immediately checked a bunch of my floppies.
>I used a recent version of VKiller.  I *did* find a virus, but I'm not
>certain it came from the June ST User disk.
>
>     VKiller reported the "Green Goblin" virus.  I'm not sure where
>this virus usually resides, but when I checked my June ST User disk
>VKiller reported no virus present.  It didn't find a virus on any of
>10 other disks I also checked.  This brings to mind that 1 of the things
>I looked at from the Net recently was this "only_ste.lzh" sound
>demo package.  Now this is a strange package with what seems to
>be a whole disk compressed into an ".MSA" file which in turn was
>LHARC'd.  I unpacked this kit just this morning.  When I unpacked
>the disk I used the MSA.PRG auto-formatting command.  It seems to
>me that this method of packaging might allow for transporting of
>boot sector or other viruses.  Has anybody else unpacked this demo
>kit recently?
>Jim Omura, 2A King George's Drive, Toronto, (416) 652-3880

     I have now checked about 2/3 to 3/4 of all my floppies (a few
hundred).  I found viruses on 6 disks (including the one I reported
earlier).  The pattern of infection does NOT point to either the
June 1991 ST User magazine disk, nor to the 'only_ste.lzh' file.
Rather, it looks like I probably received an infected disk about
a year ago.  Luckily, it just never had much of a chance to spread
on my disks.  I won't go into why this is so.  I have a fairly good
st dumb luck.  It's probably a good
idea for everyone to check their disks anyway in case I'm wrong,
but I don't think there's anything particular to worry about.
>lsuc!jimomura
>Byte Information eXchange: jimomura


-- 
Jim Omura, 2A King George's Drive, Toronto, (416) 652-3880
lsuc!jimomura
Byte Information eXchange: jimomura