Subject: viruses

From: Wind In His Hair <[email-masked]>
Date: Wed, 11 Mar 1992 19:28:00 GMT

Dear all,

   PLEASE NOTE THAT THIS IS NOT YET CORROBORATED AS BEING CONNECTED WITH
   ANY CHINESE SOFTWARE AT ALL.

   Recently I pulled back a version of NJSTAR from ahkcus.org.  I have run
it quite happily on a PC AT we have here.  Last thursday night when resetting
the date to temporarily avoid danger of losing files due to the Michaelangelo
virus, the date was set to the 7th May accidentally.  On reboot, and running
the Norton editor, a little green worm began to move around the screen.
Whether the worm is part of the virus we found or one which we haven't been
able to find, I'm not sure.

We have done some research since and found that according to some virus
detection software we have available, it is thought to have come from the Far
East possibly Taiwan.  As the NJSTAR executable is infected at present, I
thought I'd post this information here, to see if anyone can help me track down
where it may have come from.

   The number assigned it is 1575 in our documentation
(belonging to ViruScan V74+/IBM Scan 2.00+).  It is thought to be common, and
leads to .COM and .EXE growth and increased sluggishness of DIR commands.  It
installs itself memory resident when the first program infected by it is
executed, in approx. 1800 bytes at the top of the system memory but beneath
the DOS boundary at 640K.  It can be overwritten apparently, as the memory
is not reserved.  COMMAND.COM gets infected at this point and Interrupt 21
gets hooked (I don't know what this means though!)

   It seems that the virus does no more than replicate itself, but it updates
the file data and time of each file it infects to the current system date and
time.  It infects one .COM and one .EXE file each time either COPY or DIR is
used.  Infected files also show an increase of around 1580 bytes in size.

   I don't wish to alarm or point fingers at anyone;  I would be grateful if
people could tell me whether they have encountered this or other viruses on
the Chinese bulletin boards.  It seems that the virus is activated on the
first May and switches off at the end of August.

Danny Cox, CADDETC, University Of Leeds, 171 Woodhouse Lane, Leeds, LS2 3AR, UK
Phone (010-532) 334457 Internet : [email-masked]
                       BITNET   : [email-masked]