Path: utzoo!utgpu!watserv1!watmath!ria!uwovax!2011_552
From: 2011_552@uwovax.uwo.ca
Newsgroups: comp.sys.amiga
Subject: Re: VIRUS DAMAGE, CONSEQUENCES (Hate Mail)
Message-ID: <4630.25a8ba9a@uwovax.uwo.ca>
Date: 8 Jan 90 21:06:50 GMT
References: <50524@bbn.COM>
Lines: 45

In article <50524@bbn.COM>, ghewes@bbn.com (Gerald Hewes) writes:
> ------------ Help ------------
> 
>  This weekend I was bitten by a D***ed virus.
> Its probably an old known one because I suspect
> I caught from a FISH disk from 200-250.
>  The virus is attached to the executables and adds
> exactly 1124 bytes to them. I have not yet figured
> out what damages it does. It managed to get at MOST
> of my executables (99% of those in my path were hit,
> much less out of the path). It has even affected executables
> I know I have not run in the last year. Also some (=10%)
> of the executables will no longer run, guruing my AMIGA.
> 
>  Could somebody reply to me in e-mail if this is a 
> classic(!) or on the net if it may be of interest to
> others. I am mostly interested in the effect it has and 
> the way it spreads to help me cleanup my disk. It is
> not the IRQ virus.
> 
> ----------- Hate -----------
[fully justified hate letter omitted]

This sounds like the "XENO" virus mentioned on page 2 of _Amazing_Computing_
v5.1.  (My copy just arrived today).

Symptoms:

    - command in the c directory are 1124 bytes longer.
    - date on an executable has been changed to a recent date
    - the machine crashes when printing to the parallel port.
    - 'file not an object module' when using common c commands
      (dir, cd, assign, etc.)

Remedies:
    - VirusX4.0 detects the virus in memory.  KV disables the infected
      executables (but does not remove the virus from the file).

    - XenoZap will search a device for the virus and disable all
      infected files.
-- 
Terry Gaetz         --  gaetz@uwovax.bitnet  --  gaetz@uwovax.uwo.ca
Astronomy Dept.     --
U. Western Ontario  --  (this space intentionally left blank)
Canada              --