From lehigh.edu!virus-l Thu Apr 1 03:22:20 1993 remote from vhc Received: by vhc.se (1.65/waf) via UUCP; Thu, 01 Apr 93 19:13:50 GMT for mikael Received: from fidoii.CC.Lehigh.EDU by mail.swip.net (5.65c8-/1.2) id AA01613; Thu, 1 Apr 1993 16:22:38 +0200 Received: from (localhost) by Fidoii.CC.Lehigh.EDU with SMTP id AA45618 (5.67a/IDA-1.5 for ); Thu, 1 Apr 1993 08:22:20 -0500 Date: Thu, 1 Apr 1993 08:22:20 -0500 Message-Id: <9304011143.AA00874@first.org> Comment: Virus Discussion List Originator: virus-l@lehigh.edu Errors-To: krvw@first.org Reply-To: Sender: virus-l@lehigh.edu Version: 5.5 -- Copyright (c) 1991/92, Anastasios Kotsikonas From: "Kenneth R. van Wyk" To: Multiple recipients of list Subject: VIRUS-L Digest V6 #54 VIRUS-L Digest Thursday, 1 Apr 1993 Volume 6 : Issue 54 Today's Topics: April Fools' Day disclaimer Viral ghosts and other computer faults here; break in Virus-L service Wanted:missing *Ninja Turtles*! WARNING - virus hits Florida! Latest list of viruses Et tu, Brute? VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a non-digested Usenet counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc. (The complete set of posting guidelines is available by FTP on cert.org or upon request.) Please sign submissions with your real name. Send contributions to VIRUS-L@LEHIGH.EDU. Information on accessing anti-virus, documentation, and back-issue archives is distributed periodically on the list. A FAQ (Frequently Asked Questions) document and all of the back-issues are available by anonymous FTP on cert.org (192.88.209.5). Administrative mail (comments, suggestions, and so forth) should be sent to me at: . Ken van Wyk, krvw@first.org ---------------------------------------------------------------------- Date: Thurs, 1 April 93 00:00:00 -0000 From: "Kenneth R. van Wyk" Subject: April Fools' Day disclaimer VIRUS-L/comp.virus readers: It is with great consternation that I include the following disclaimer in today's digest: For the humor-challenged, today (1 April 1993) is April Fools' Day. Lest any of the gems in this digest be mistaken for anything less than the good-natured humor for which they were intended, please be advised that THE MESSAGES IN THIS DIGEST ARE JOKES. (Well, except for this one...) Anyway, enjoy these JOKES on this April Fools' Day, and remember - ten thousand lemmings can't be wrong! ;-) Special thanks to all those that contributed to today's digest; I owe you each a homebrew! Cheers, Kenneth R. van Wyk Moderator, VIRUS-L/comp.virus ------------------------------ Date: Thurs, 1 April 93 00:00:00 -0000 From: A.APPLEYARD@fs1.mt.umist.ac.uk Subject: Viral ghosts and other computer faults here; break in Virus-L service Subsequent to the recent succession of 'sightings' by PC antivirals of ghosts of killed viruses, a recent wave of otherwise unexplained miscellaneous computer errors and programming occurences was suspected to be due to activity by these ghosts. Early this morning the Ghostbusters were called. They found and removed four Jerusalem and three DIR-II and two other viral ghosts which had become free-roamers with gremlin tendencies, and the ghosts of two former computer operators, and the ghost of a man who died in a fall from his horse on this site in 1823. Their Mr.P.Venkman said after a thorough PKE search that our computer building is now free of ghosts and similar harmful infestations, and commented that "past-life repeaters all too often become hostile on finding that they have the will but not the skill to continue the occupations that they had before death.". However, as in the process link wiring and a disk drive were damaged by beams from their proton packs, no more Virus-L issues can be sent out for the next week. ------------------------------ Date: Thurs, 1 April 93 00:00:00 -0000 From: brunnstein@rz.informatik.uni-hamburg.dbp.de Subject: Wanted:missing *Ninja Turtles*! Virus Test Center would very much appreciate any help in finding, identifying and securely catching the following missing *Ninja Turtles*: *Donatello*, possibly a UNIX virus living on NeXT systems, said to kill all files on March 5! Alternately, may live on Amigas! *Leonardo* and *Rafaelo* whose system basis is not known, and whose activities and trigger conditions are also unknown. All three are members of the family of *Ninja Turtles*, from a French comic on 4 turtles named, by their master former Mr. Hamato *Joshi* now Mr. Splinter (who was converted into a *Rat*) after his 4 favorite Italian painters, including master turtle *Michelangelo* (known to "live" on PC-DOS and killing 21 MByte on March 6). At this time, only *Michelangelo* (which is also known as Ninja Turtle in Asia) has appeared in the public and reproduced worldwide. Some messages refer to some *Donatello* virus (Amiga?, NeXT?), but nothing is known about their sister turtles. Background info #1: Ninja Turtle is a comic about 5 former humans which were transformed into animals when contaminated with radioactive mud. While master Mr. Hamato Joshi was transformed into a rat with the name Splinter, the other 4 became turtles named after 4 Italian painters (see below). Splinter has a girlfriend named April. Background info #2: The following relations to existing malicious software (esp. viruses) have been found: - Ninja Turtle is the Taiwanese alias of Michelangelo virus - Joshi and Rat are PC viruses (April 1st in Jerusalem strain) - Donatello was the name of some "file" which has been found on a NeXT machine in a US university, in 1992; moreover, a virus of this name has been mentioned on Amigas. Background info #3: the referenced Italian painters had the following life- dates: Donatello: born 1386 (day/month not known), died 13-Dec-1466 Raffael: born 1483 (day/month probably 6-April), died 6-April-1520 Leonardo: born 15-April-1452, died 2-May-1519 All information concerning the turtles securely contained on diskette should be send to University of Hamburg, Faculty for Informatics Virus Test Center: Klaus Brunnstein Vogt-Koelln-Str. 30 D 2000 Hamburg 54, Germany Thanx for your cooperation Klaus Brunnstein (April 1, 1993) ------------------------------ Date: Thurs, 1 April 93 00:00:00 -0000 From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson) Subject: WARNING - virus hits Florida! Recently, the University of South-West Florida Agicultural Laboratory discovered that several hundred of their floppy disks had become unusable and when accessed fouled the heads of the disk drives used requiring complete disassembly/cleaning of affected drives. The cause has been isolated as a gene-spliced mutation of a tobacco mosaic that had been used for laboratory experiments. Inadvertant exposure to mutagens resulted in a new strain with an appetite for ferric oxides used to coat floppy disks (both 5 1/4 and 3 1/2). The residue left by the new strain caused the fouling of the heads in affected drives. Unfortunately, the problem was discovered only after distribution of several thousand disks relating to citrus projections that were sent to agencies and universities worldwide. The mosaic reverts to a dormant state when exposed to temperatures below 60 degrees F and takes from a week to a month to revert to an active state following dormancy. The noted USWF researcher, Dr. Ludwig Von Drake, was quoted as saying: "Well now we have a real computer virus". -30- ------------------------------ Date: Thurs, 1 April 93 00:00:00 -0000 From: Y. Radai Subject: Latest list of viruses [I thought this would be of interest to the readers. I don't know who compiled the list originally. -- YR] ------------------------------------------------------------------ PAUL REVERE VIRUS: This revolutionary virus does not horse around. It warns you of impending hard disk attack -- once if by LAN, twice if by C:. RIGHT-TO-LIFE VIRUS: Won't allow you to delete a file, regardless of how old it is. If you attempt to erase a file, it requires you to first see a counselor about possible alternatives. DAN QUAYLE VIRUS: Prevents your system from spawning any child processes without joining into a binary network. DAN QUAYLE VIRUS 2: Their iz sumthing rong with yore compueter, ewe just cant figyour owt watt. MARIO CUOMO VIRUS: It would be a great virus, but it refuses to run. GEORGE BUSH VIRUS: It starts by boldly stating, "Read my test ... no new files!" on the screen, proceeds to fill up all the free space on your hard drive with new files, then blames it on the Congress Virus. ROSS PEROT VIRUS: Activates every component in your system, just before the whole thing quits. ARNOLD SCHWARZENEGGER VIRUS: Terminates and stays resident. It'll be back. MICHAEL JACKSON VIRUS: Hard to identify because it is constantly altering its appearance. This virus won't harm your PC, but it will trash your car. ELVIS VIRUS: Your computer gets fat, slow, and lazy and then self destructs, only to resurface at shopping malls and service stations across rural America. OLLIE NORTH VIRUS: Turns your printer into a document shredder. TERRY RANDLE VIRUS: Prints "Oh no you don't" whenever you choose "Abort" from the "Abort, Retry, Fail" message. TED TURNER VIRUS: Colorizes your monochrome monitor. JIMMY HOFFA VIRUS: Nobody can find it. ADAM-AND-EVE VIRUS: Takes a couple of bytes out of your Apple. LAPD VIRUS: It claims it feels threatened by the other files on your PC and erases them in "self-defense." CONGRESSIONAL VIRUS: The computer locks up, screen splits erratically with a message appearing on each half blaming the other side for the problem. CONGRESSIONAL VIRUS 2: Runs every program on the hard drive simultaneously, but doesn't allow the user to accomplish anything. FEDERAL BUREAUCRAT VIRUS: Divides your hard disk into hundreds of little units, each of which does practically nothing, but all of which claim to be the most important part of the computer. GOVERNMENT ECONOMIST VIRUS: Nothing works, but all your diagnostic software says everything is fine. HEALTH CARE VIRUS: Tests your system for a day, finds nothing wrong, and sends you a bill for $4,500. STAR TREK VIRUS: Invades your system in places where no virus has gone before. AT&T VIRUS: Every three minutes it tells you what great service you are getting. THE MCI VIRUS: Every three minutes it reminds you that you're paying too much for the AT&T virus. PBS VIRUS: Your PC stops every few minutes to ask for money. POLITICALLY CORRECT VIRUS: Never calls itself a "virus," but instead refers to itself as an "electronic microorganism." OPRAH WINFREY VIRUS: Your 200MB hard drive suddenly shrinks to 80MB, and then slowly expands back to 200MB. TEXAS VIRUS: Makes sure that it's bigger than any other file. AIRLINE VIRUS: You're in Dallas, but your data is in Singapore. SEARS VIRUS: Your data won't appear unless you buy new cables, power supply, and a set of shocks. NEW WORLD ORDER VIRUS: Probably harmless, but it makes a lot of people really mad just thinking about it. GALLUP VIRUS: Sixty percent of the PCs infected will lose 38 percent of their data 14 percent of the time (plus or minus a 3.5 percent margin of error). IMELDA MARCOS VIRUS: Sings you a song (slightly off key) on boot up then subtracts money from your Quicken account and spends it all on expensive shoes it purchases through Prodigy. FREUDIAN VIRUS: Your computer becomes obsessed with marrying its own motherboard. NIKE VIRUS: Just Does It! KEVORKIAN VIRUS: Helps your computer shut down whenever it wants to. CLEVELAND INDIANS VIRUS: Makes your 486/50 machine perform like a 286/AT. CHICAGO CUBS VIRUS: Your PC makes frequent mistakes and comes in last in the reviews, but you still love it. ------------------------------ Date: Thurs, 1 April 93 00:00:00 -0000 From: "Buford T. Buckeye" Subject: Et tu, Brute? Has anyone heard anything about the following virus? We are VERY concerned: > We have found a new virus on our local systems. Analysis of the code > reveals the following: > The virus contains the text "LEFco" and infects either files, boot > sectors, or partition tables ... (Actually, it can't decide!) > The virus tries, but it can't go resident because it disables the CPU's > memory management and scheduling and installs its own "organizer" routines. > These routines are highly ineffective and cause tremendous system > disorganization, leading to utter chaos and pandemonium. Printers produce > disk output, disks begin printing, and monitors play "Dazed and Confused". > The virus blames this chaos on other system applications such as CHKDSK. > On multitasking systems, processes and sessions will randomly appear and > disappear without warning. In fact, some of the sessions will rearrange > and jump into other sessions! > The virus also invites other viruses to your machine and forces them to use > tokens before allowing them to sit on the hard drive. Unfortunately, there > isn't enough disk space and the extra viruses are forced to stand in > memory or go out on floppy diskettes. > After the confusion, the virus keeps printing "Next year will be better! > > This is the worst virus we've ever seen! Oh! The humanity! > Please! Can someone help us!! If you have had any experience with such a virus, please send advice, helpful hints, and suggestions. However, we won't have time to read them, so you might as well copy them to NUL or /dev/null. Thanks anyway! B.T. Buckeye ------------------------------ End of VIRUS-L Digest [Volume 6 Issue 54] *****************************************