Path: utzoo!attcan!uunet!cs.utexas.edu!samsung!uakari.primate.wisc.edu!larry!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.virus Subject: New variant of Cascade/1704 (PC) Message-ID: <0005.9002211611.AA05733@ge.sei.cmu.edu> Date: 19 Feb 90 10:10:20 GMT Sender: Virus Discussion List Lines: 22 Approved: krvw@sei.cmu.edu Some time ago I reported that 1704 seemed able to infect the same file over and over on a Novell network. I now have a copy of the virus in question, and it appears that this has nothing to do with Novell networks - it is just a new variant of the virus. It is possible that this virus was created by a random mutation, which seems to have changed one JA instruction into JNE, but it is not certain. Because the author of 1704 did not include self-correcting Hamming code in the virus :-), the mutation spread - and spread faster than the original, "healthy" variant. All programs which are able to detect and remove the "standard" 1704 virus should also be able to handle this variant. - -- Fridrik Skulason, University of Iceland E-Mail: frisk@rhi.hi.is Technical Editor, Virus Bulletin (UK). Fax: 354-1-28801