From:	ARISIA::EVERHART     "Glenn Everhart 215 354 7610 Everhart%Arisia.dnet.ge.com"  3-OCT-1991 13:31:04.83
To:	EVERHART
CC:	
Subj:	new virus bandaid

 
The virus is not able to infect disk partitions, which are accessed
through an installable device driver. Therefore, partitions accessed
through programs like Disk Manager are immune against this virus.
 
Here is a small TSR program that, when resident in memory, will
prevent you from executing or copying a file, whose directory entry is
infected by this virus. The program is supposed to detect if the virus
is already present in memory, but it sometimes fails to do so.
 
IMV.XXE
QXXNCD Ver. 1.2, by Theodore A. Kaldis.
BEGIN--cut here--CUT HERE--
begin 644 imv.com
huI+-4OKXKeBCcNFg8rlUcqGZc3-HIPWZdPg1+PY6+0sl-oB1sjZNKpX1yyFV
hI3ASAxiCqsgSP+G1kk6A+yNVg9PaEv1WtY8k+yN0Cltg-5LuUwA1g8baEf+4
htY6v5ak2RTcTKpXaMQDceDyoIgoV7jxrzXD+XhWV2kGuE+1rscjE5nDqjkA-
hiEU+wuRp+zbf0cnME6vMCw7muDUC5ks5u55zkp3KJkMC-sjmjkA-iEU+u3zz
hwuSQu3bzbTVp+TY5LptNksP2ik+-nnr-dLHpUDl9R-O+z2-o+ihFuALzQonc
hFzys-E1tmU6+I3BFIVus+1rc8k1pQm49q+sTiXA0iF++h1zc4E1pQkUvkTVp
h+yWFztmoDiU6+7oTKZZPKCiy9cw4AE8Q1WvzBX20uU++++++++++++++++++
h++++++++++0uVE8o0QoVu-jziXE1QWqskOLB6HqZkPcO+rEUi02pnG475Wo0
hX+Mj+ff8+PEZnG4uxk8o0QoViYA0nGSo0QoVnG+B0YZhMKRdPa3oOKxi62pZ
hPKxmSG-KMKBXOKtZ90-KNL7nOKxi612iA12g63-ZR4Jm62FdPKxq90+lCHYl
h1EcU60+U60+U60+U63-mPrFZMrFn643bMKZiQrEUF4Zm62Z760V4EJEUOqZg
hP4Jm8Eo80WF7HJMUAGsk64ZiQrFVP4lZN0-nRKBXNLBnNbJgP5Yi1Ec872ZB
hJW-dQm-VP57ZMKFt643XR4ZqNGsB0UcYJm--636UHW-762sUFm+V6G+UJ4VZ
h62FdQW-7GG-qOL7pQm-dQm-VP57ZMKFt65-mNLBZPbEUOKsUPKJhPr7t6EQB
10UcY
+
end
633
END--cut here--CUT HERE--
 
According to my reports, at least two more different mutations of this
virus are available in Bulgaria, but they are not as widespread. I
predict that this virus will become a large threat to the whole world
before the end of the year. It is much more infective than Stoned and
will still are unable to stop the spreading of the latter. Probably
this virus will become to the IBM PC world what WDEF has become for
the MACs... :-(
 
One last remark. I have a program that successfully disinfects this
virus. If there are major infections and sufficient interest, I'll
send it to Ken and shall ask him to make it publicly available. The
current problem is that the program has no docs (more exactly, they
are in Bulgarian <grin>).
 
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev         Universitaet Hamburg, FB Informatik - AGN
Bontchev@Informatik.Uni-Hamburg.de   Schlueterstrasse 70, D-2000 Hamburg 13
New address after October 1, 1991:   Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
