From: felscher@maplog.informatik.uni-tuebingen.de
Newsgroups: comp.virus
Subject: a report on a viral infection (PC)
Date: 21 Jul 92 10:29:18 GMT

Report on a viral infection

1.

On Dec.11, 1991, I was informed that a *.com file, which I
had sent to someone, did contain the cascade virus.

Immediate check with the then most recent version of scan
reported the presence of [1701] in about 15 recently used
*.com files on the PC.

Inspection of the commentaries for the files in TROJAN-PRO
of SIMTEL suggested that the program "dvir1701.exe" would
remove the virus and heal the files. Consequently,
"dvir1701.exe" was applied, and the affected *.com files
were restored to their original sizes. They now all bore the
date of 11.12.91 and the same time.

2.

Since then, the PC in question ran without trouble. Whenever
new software was tested, it was subjected to scan before,
and no infections were noticed.

On the morning of June 28, the PC crashed after a batch file
had been run, loading fonts into a printer, immediately
after booting. During the crash, there appeared "110  / ?????"
on the screen.

The PC, an old PS2/80, is operated with a complicated memory
management. It thus was suspected that a mixup had occurred
during the cache management, and the PC was rebooted from a
floppy (older than 11.12.92), containing the same
configuration. Then autoexec.bat was loaded into an editor
and several lines, which might have been the cause for the
crash, were commented out. When the save command of the
editor was given, the machine crashed again.

An attempt to reboot the machine did fail. When the machine
was rebooted from the original (write protected) DOS boot
floppy, it turned out that several filenames on drive c: had
changed, loosing characters. Also, autoexec.bat had
disappeared. Upon these observations, it was concluded that
a virus might be present, and the then latest version of
scan, 91, was gotten from a SIMTEL mirror.

Scan91 reported [170X] in memory, but did not report any
affected files. It also reported the FAT of c: to be
incorrect.

Clean91 cleared the memory. Inspection of FAT with help of
Norton Utilities showed at least one glaring error,

    216 217 218 4059 EOF 221 ...

while the highest block number on c: was 485 . It was
guessed that the correct entry should read 219, and when
this was entered manually, the FAT was reported to be
correct.

Still, the machine did not boot from c: , and it was
concluded that the boot sector was affected.

Inspection of the commentaries for the files in TROJAN-PRO
of SIMTEL suggested that the program "m-disk.zip" might
clean the boot sector.  As the machine runs DOS 3.3 ,
"md33.exe" was tried. It did restore the boot sector, and
the machine now would boot from c: .

After booting in this way, Scan91 again would report [170X]
in memory. Checking one by one the files called from
autoexec.bat, it turned out that

(1) several of them were healed *.com files from 11.12.91
    (e.g. a tiny file, written by myself, putting NC on F2,
    and another one removing the numerical lock)

(2) whenever the PC was floppy-booted (and Scan91 then
    reported no virus in memory) and then one of the
    supposedly healed *.com files was run, Scan91 again
    reported [170X] in memory.

Upon this observation, all healed *.com files from 11.12.91
were removed and replaced by either original versions or
newly written ones.