TIP: Click on subject to list as thread! ANSI
echo: virus_info
to: KURT WISMER
from: MACK BARSS
date: 1997-05-04 17:08:00
subject: WAZZU.A virus and Win95.

Kurt Wismer wrote in a message to Mack Barss:
 MB> Now comes the really annoying part... even if I boot with a Win95
 MB> system diskette that is write protect and run the various virus
 MB> scanning programs they will all indicate that no virus was found. 
 MB> However, as soon as the system boots normally from the hard drive and
 MB> VShield kicks in, it indicates that it has found traces of the WAZZU.A
 MB> virus in memory and always at the same location (448k).  
 KW> wait, it's popping up as soon as you boot? as in before ms word
 KW> ever gets loaded?
If I booted the system from floppy (either DOS 6.22, Win95's DOS 7.1) and ran 
Scan and VSheild there would be no virus found nor detected.  When booting
from the hard drive, VShield would report the virus in memory.  I know that
WAZZU.A is a WORD macro virus.  Did some more testing of the system and have 
discovered that when Win95 was booted to just the command prompt and VShield
was run, that there was no virus report.  The detection of the WAZZU.A virus
was only detected when booting to the Win95 gui.
I have scan the entire system (all files) and no viruses were found.
Now correct me if I'm wrong... but doesn't VShield use the same signature
dat file as Scan?
 KW> which is not to say you don't have any problem at all, when did
 KW> this whole thing start? did it coincide with an upgrade of the
 KW> vshield program? if so it could be just a bug... otherwise it
 KW> sounds like something that gets loaded automatically during bootup
 KW> has been corrupted is a very particular way.. (possibly a system
 KW> file got grunged by an actual instance of a wazzu infection that
 KW> has since been cleaned up - which isn't supposed to happen, but...)
 KW> try telling your scanner to scan all files next time you use it... 
Have gone through all the SCAN/VSHIELD logs and there was no indication
of the WAZZU.A virus.  The problem has been recitified... foramt/re-install.
      Mack
--- timEd/2 1.10
---------------
* Origin: Modem Connections/2 (613) 820-2594 - Nepean, Ont. (1:163/545)

SOURCE: echomail via exec-pc

Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.