Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sun-barr!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: 0004193926@mcimail.com (Ben Zajac)
Newsgroups: comp.virus
Subject: Spanish Virus/Telefonica (PC)
Message-ID: <0009.9106201437.AA20289@ubu.cert.sei.cmu.edu>
Date: 19 Jun 91 04:14:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 35
Approved: krvw@sei.cmu.edu

Recently, a virus was discovered at Oxford University, Oxford
(England) and the City Univerity at London (England).  It has been
named, "Spanish Telecom," and also, "Telefonica."

According to information that I have received from the UK, the
virus does not kick in until after the system has been booted up
400 times.

The code reportedly contains the following message:

             "Menos tarifes y mas servivios"

    Which means: "Lower tariffs, more service"

Damage -- When triggered, destroys (overwrites) hard disks.

Detection:

     The virus is in *.COM files and boot sector.

     Pattern:

     Header 1 - 881D 8200 83FB 0074 188F 5500 B2; OFFSET 034H

     Header 2 - 83ED 09BE 2001 03F5 FC86; OFFSET 024H

     Boot Sector -

                8A0E EC00 8E700 0003 F18A 4C02 8A74 03C3;OFFSET 083H

I have not personally examined this virus, however the I have no
reason to doubt the source.

           Bernard P. Zajac, Jr.
           MCI MAIL - 4193926@MCIMAIL.COM