Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA03594; Tue, 19 Jun 90 08:07:15 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA28893; Tue, 19 Jun 90 08:07:11 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA02389; Tue, 19 Jun 90 08:07:02 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa12832; 19 Jun 90 12:38 BST From: Anthony Appleyard To: DAVIDF@cs.heriot-watt.ac.uk Date: Tue, 19 Jun 90 09:43:24 BST Message-Id: <$TGWFCWKBBCVT at UMPA> Subject: Here is Virus-L vol 0 #0928 Virus-L Digest Wed, 28 Sep 88, Volume 0 : Issue #0928 Today's Topics Time Magazine article Book from virus conference Real (Conference Proceedings) ** no subject, date = Wed, 28 Sep 88 15:49:43 PDT FSP_12 RE: FSP_12 ------------------------------ Date: Wed, 28 Sep 88 01:07:20 EDT From: "David A. Bader" Subject: Time Magazine article The story on viruses in the latest issue of Time Magazine has spurred a LOT of conversation on this local area's Bulletin Board Systems. Of the half-dozen that I have been logged into tonight, MOST have had conversation regarding the integrity of their files, and also different scare stories of "other viruses." David A. Bader DAB3@LEHIGH -------------------- Date: Wed, 28 Sep 88 09:39:26 EST From: "Conrad Jacoby (DC)" Subject: Book from virus conference Hi there!! Is there any way that the book mentioned in Loren's description of the upcoming virus convention could be made available to the more general public? I and the people I work for would be very interested in such a volume. And obviously, we'd pay money for it. - ----------------------------------------------------------------------------- Conrad J. Jacoby P.O. Box 3805 Yale Station Yale University New Haven, CT 06520 Sterling Memorial Library (203) 436-1402 "Generalist at Large" Jacoby@YaleVm.Bitnet - ----------------------------------------------------------------------------- -------------------- Date: Wed, 28 Sep 88 08:47:00 MDT From: "David D. Grisham" Subject: Real (Conference Proceedings) Sorry for the last piece of unintended mail. (a stuck buffer) Anyway- I personally would like to place a request early, for the "book" of papers, etc. that Loren referred to in her last letter. I imagine that I am not the only one who does not have the travel funds, but can spring for the proceedings. Dave -------------------- Date: Wed, 28 Sep 88 15:49:43 PDT From: David Voss >Well gentlemen (and women), it seems that a virus has struck >Tucsaloosa and >I've been called on to try and help. I haven't seen the infected >computers yet, but here is a discription of what I do know. > 1) The FAT that points to valid data space > corrupted. > It shows one giant corrupted file. > 2) All data has been overwritten with FF(hex) >The computers are backed up once a week, so there is a copy of the >data >that was lost. However, transactions since then are not recorded. Is >there any way to recover the corrupted data? (I believe that they >were using COMPRESS, MIRROR and PCBACKUP to back up the files...) >Any hints on what this problem might be? Its rather important to >find out, since the affected facility is in the health field. By 'corrupted data' do you mean FAT data? Your note is a bit ambiguous. Is it the FAT that has been overwritten with FF hex? If just the FAT (file allocation table, of which DOS maintains two copies, by the way) is destroyed, you can use CHKDSK to collect the data into a series of files (named FILExxxx.CHK, where xxxx is a sequential number) that can then be scanned with something like the Norton Utilities. This only is effective with clear ASCII text, not compressed files. The data can be recovered, but it takes work. If, however, the data has been overwritten there is no hope of recovery. Data entered after the last backup is gone. The problem could be a virus, or it could be something else. It's important to isolate the software that was being used during the crash and check against master copies. -- David Voss [fb.dfv@stanford] -------------------- Date: Wed, 28 Sep 88 20:20:00 EDT From: Santanu Sircar Subject: FSP_12 Does anyone have an ARC-ed version of Flu-Shot v1.2? I was not able to correctly decode FSP_12.UUE which I received from LISTSERV@LEHIIBM1. Thanks. -Santanu Sircar- (SSIRCAR@UMAECS) -------------------- Date: Wed, 28 Sep 88 20:27:00 EST From: ZDABADE@VAX1.CC.LEHIGH.EDU Subject: RE: FSP_12 FSP_12 is very buggy. Why not try FSP_14? -David /-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ | From: David A. Bader, Studentis Maximus | | DAB3@LEHIGH SloNet: 1402 Lorain Avenue | | ZDABADE@VAX1.CC.LEHIGH.EDU Bethlehem, Pa. 18018 | | HACK!DAB@SCARECROW.CSEE.LEHIGH.EDU | | SchoolNet: Box 914, -On a mostly harmless | | Lehigh University, blue green planet... | | Bethlehem, Pa. 18015 -And loving it! | \________________________________________________________________________/ -------------------- *** end of Virus-L issue ***