Path: utzoo!attcan!uunet!portal!cup.portal.com!LaserMan
From: LaserMan@cup.portal.com (Bob LaserMan Murrow)
Newsgroups: comp.sys.mac
Subject: Re: The NEW nVIR (just the facts, ma'am)
Message-ID: <12813@cup.portal.com>
Date: 21 Dec 88 19:54:33 GMT
References: <4Xb0I9V28k-0A1zVwN@andrew.cmu.edu> <65@sdacs.ucsd.EDU>
Organization: The Portal System (TM)
Lines: 26

I have a new virus that may be the NEW nVir. The virus I got uploaded to my
BBS PhoenixII at 408-252-3926 is of the type Hpat. It infects your SYSTEM
file the first time it sees it. It is caught by Vaccine on boot but may be
able to get by Vaccine if it is in a program that runs from a floppy. I 
modified a copy of RWatcher to catch it. It builds the following resourses:
In an application:
	Hpat 1 size 428
	Hpat 2 size 8
	Hpat 3 size 416
	Hpat 6 size 66
	Hpat 7 size 2106
	INIT 32 size 416
	CODE 255 size 422
In your SYSTEM:
	Hpat 0 size 0
	Hpat 1 size 428
	Hpat 4 size 442
	Hpat 5 size 8
	Hpat 6 size 66
	Hpat 7 size 2106

I am in the process of dissassembling this thing to see if it is going to be
nasty. At first glance it appears to be only replicating itself and not doing
damage.
Bob Murrow
laserman@cup.portal.com