Path: utzoo!utgpu!attcan!uunet!husc6!mailrus!bbn!diamond.bbn.com!mlandau
From: mlandau@bbn.com (Matt Landau)
Newsgroups: news.sysadmin
Subject: Re: The virus
Message-ID: <12090@jade.BBN.COM>
Date: 4 Nov 88 01:18:03 GMT
References: <5311@medusa.cs.purdue.edu>
Reply-To: mlandau@bbn.com (Matt Landau)
Organization: BBN Systems and Technologies Corporation, Cambridge, MA
Lines: 6

The virus also appears to try to compile things in /tmp or /usr/tmp.

One thing you can do is move /bin/cc to some other name, and install 
a shell script in /bin/cc that checks to see if it's being invoked 
from within one of your temp directories.  This will help catch the 
virus as it tries to infect a new system.