Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!samsung!think.com!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: p1@arkham.wimsey.bc.ca (Rob Slade)
Newsgroups: comp.virus
Subject: Possible PC Virus (PC)
Message-ID: <0013.9106181359.AA17901@ubu.cert.sei.cmu.edu>
Date: 18 Jun 91 03:51:07 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 20
Approved: krvw@sei.cmu.edu

7340P@NAVPGS.BITNET (robert c. morales) writes:

> replicated themselves with such names as EDLIN._OM and AUTOEXEC._AT,
> all of which were 77 bytes in size with the same dates and times. This
> necessitated reformatting the hard drive. Also, the Dosshell was

Ouch.

I don't want to take any guesses as to your approximately 15K file, but I
would venture that someone has been wandering around your office with a
copy of Norton Antivirus, right?  The 77 byte files are the "file
signatures" that it uses to detect changes in infected programs.


=============
Vancouver          p1@arkham.wimsey.bc.ca   | "If you do buy a
Institute for      Robert_Slade@mtsg.sfu.ca |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security