Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: PETI1010@DOSUNI1.BITNET Newsgroups: comp.virus Subject: New Virus? (PC) Message-ID: <0013.9106101933.AA10096@ubu.cert.sei.cmu.edu> Date: 7 Jun 91 22:35:16 GMT Sender: Virus Discussion List Lines: 32 Approved: krvw@sei.cmu.edu Hello Netlanders, we yesterday observed strange behaviour on one PC with 386 DX (in Osnabrueck W-Germany). Chkdsk reported an "Allocation error, size adjusted" on several Exe-Files. For example KRNL386.EXE and KERNEL.EXE of Win 3.0 but not the KRNL286.EXE. Windows worked only in Standard-Mode but in Real and 386 Enhanced the System crashed. Scanning the HD after booting from Floppy (I hope a clean one :-)) with F-PROT 1.15a and SCAN v 77 revealed nothing. Restoring the obviously damaged files we observed an increase of the File-Length of 4280 bytes in case of the damaged (infected ?!) files. Maybe any kind of Tequila shows his (ugly :-() face? Any suggestions? Regards, Frank Petersen B.t.w.: I'll send a copy of an infected file together with the uninfected version to Ken. Maybe he'll be so kind to pass it to the masses of famous :-) and intelligent (and so on) virus researchers, so they can have a close look at the nasty stuff. (Thanks Ken). **************************************************************************** * _________ _________ * * * / ______/ / ___ / * via EARN/BITNET: PETI1010 @ DOSUNI1 * * / /____ / /__/ / * * * / _____/ / _____ / * via FIDONET: (2:245/20.9) * * / / / / * * * /__/ rank /__/ etersen * Reserved for future expansion * * * * ****************************************************************************