Virus Warning and Questions

[HAVERLAND MARC BRADLEY]

I seem to be experiencing a virus on my machine and three other machines
that have exchanged files.

I have not experienced this before, and am not very familiar with
this class of problem. If anyone would like to tell me what they
know about viruses, any information would be most appreciated. I
will post a summary if requested.

The following is a description of what this thing looks like and
acts like, as far as I have been able to tell in one night.

o It only affects .com and .exe files.
o Infected .exe files seem to run fine, but infected .com files hang.
o A clean .com file will run fine until an infected .exe is run. Any
subsequent execution of any .com file will infect that particular file.
o Infected .com files seem to be 1813 bytes longer than uninfected ones.
o The beginning of infected .com files is affected, and various locations
in infected .exe files is affected.
o The following seems to be a reliable signature:
e9 92 00 73 55 4d 73 44 6f 63 (Hex ASCII)
. . . s U M s D o s (ASCII)
o This is only the first part of the changes made to the beginning of
.com files. There is more, but searching for this seems reliable.
o This shows up at the beginning of infected .com files, and sometimes
at approximately offset 1555.
o Using the Norton Utility TS (TextSearch) and searching for the string
sUMsDos seems to be a reliable check.

Has anyone experienced this? What exactly do virus detectors do? Can
they clean up infected files, or do they just check them out?

Any suggestions, comments, or education on this subject would be appreciated.

Thanks,

Marc Haverland have...@tramp.colorado.edu 303-650-1100 303-266-6990

[tim anderson]

This virus was found once before at Computervision/Prime. It was on one
of the computers that was used for everyone to copy files at the last
international users conference in Boston. Needless to say, anyone that
copied files at Computervision's international users conference recieved
a little more than they bargained for! You have found the cure that
we used, search for that sUMsDOs string (or however it is spelt...) and
blow away those files.

[tim anderson]

I almost forgot, part of the virus infects the operating system,
so make sure you boot up with a clean version of command.com and
the other important boot up type files...

[Ross M. Greenberg]

Looks like you have the so-called "PLO" or "Israeli/Firday 13th/Black Hole"
virus. Not too serious. It doesn;t cause much damage, except some EXE's
will no longer be executable -- on Friday the 13th, it erases any file you
try to run on an infected machine.

Best bet: reboot on a clean, wrtite protected floppy. Look for "sUMsDos"
as you've found, delete the file and replace from your backups. Running
an infected program infects your machine until you power down...

Ross M. Greenberg
Author, FLU_SHOT+

--
Ross M. Greenberg, Technology Editor, UNIX Today! gree...@utoday.UUCP
594 Third Avenue, New York, New York, 10016
Voice:(212)-889-6431 BIX: greenber MCI: greenber CIS: 72461,3212
To subscribe, send mail to ci...@utoday.UUCP with "Subject: Request"

[Ross M. Greenberg]

Nope. Not this virus. In fact, it makes specific checks so it does not
infect COMMAND.COM.