NetNews Usenet Archive 1993 #3/NN_1993_3.iso/spool/comp/virus/4987

Internet Message Format | 1993-01-27 | 1.5 KB

Path: sparky!uunet!ukma!darwin.sura.net!newsserver.jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail]
Newsgroups: comp.virus
Subject: windows virus (PC)
Message-ID: <[e-mail]>
Date: 15 Jan 93 16:50:14 GMT
Sender: [e-mail]
Lines: 22
Approved: [e-mail]

I am sorry to be a nuisance, but several users of Windows at Sheffield
appear to have been hit by a virus that isn't detected directly. Using
memory resident virus checkers only detect a write to a protected file
or disc, but not the name. Scanning the disc and memory also fails to
show up the 'virus'. It appears only to infect the Windows files, and
these fail to run. It has been caught trying to write to the kernel of
windows, and has also written to other windows programs. As this has
occured to 2 different users, not using the same computers, or
software to get the same fault within 2 days of each other seems very
odd. In both cases the only solution was to reinstall windows and all
other software (including non-windows software) and hope the problem
has gone away. The common link between the two was use of HENSA to
download software at terminals at the University of Sheffield. Has
this 'virus', if it is a virus, been reported before or is it just a
bug and an unhappy co-incidence?

Once again I appologise for disturbing you, but hope that someone can
shed some light on the problem, in the mean-time we are avoiding down-
loading files.

Stephen Baines
[e-mail]