-----BEGIN PGP SIGNED MESSAGE-----

===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Don Stikvoort                               Index  :    S-95-01
Distribution  : World                                       Page   :          1
Classification: External                                    Version:      Final
Subject       : TS1423 virus (DOS)                          Date   :  13-Jan-95
===============================================================================
 
By courtesy of CERT-UvA (Huub Knops) we received information about 
the TS1423 DOS virus which may be linked to the date of Friday 13th (i.e.
today). It seems that more people are suffering from this specific virus,
reason to pass along the experience of CERT-UvA right away without the
pretentions of giving a complete analysis.
 
===============================================================================
 
De Universiteits Bibliotheek van de Universiteit van Amsterdam is vandaag
(vrijdag de 13e) getroffen door het TS1423 virus.

Degene die de fileservice vanuit de UB gebruiken worden geadviseerd
hun gebruikers te waarschuwen en hun media te scannen op bovenstaand virus.

De aan te raden oplossing is de schijf te formatteren of minimaal
alle *.exe, *.com files te removen.

Er wordt nog gezocht naar andere virusdetectie programma's die mogelijk
de virussen kunnen verwijderen.

Gebruikte viruspakketten:

MCafee (Versie: 1.17) ziet het virus wel, raadt aan om het te deleten en
"wipe-ed" het vervolgens niet (file kan teruggehaald worden met bijv.
un-delete).

Thunderbyte (Versie: 6.31) ziet het virus wel, delete/"wipe-ed" goed.

f-prot (Versie: 2.15) ziet het virus niet (noch secure, noch heuristics).
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. 
SURFnet is the Dutch network for educational, research and related institutes.
CERT-NL is a member of the Forum of Incident Response and Security Teams 
(FIRST). 

All CERT-NL material is available under:
  http://www.surfnet.nl/surfnet/security/cert-nl.html
  ftp://ftp.surfnet.nl/surfnet/net-security 
  
In case of computer or network security problems please contact your 
local CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet 
customer please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).
   Email:     cert-nl@surfnet.nl
   Phone:     +31 302 305 305
   Fax:       +31 302 305 329
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands
   A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST
   members on request.
==============================================================================

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMML8qB68tkuRYDgtAQEElgP/eyKZB2wvcS1iEzG/8sUhDeo9j+U1hYfJ
Wxy6m7NzgVXLOROUbAayb2hgIG+sogdvB5rGWmJCRI+DtnXbuAmkd7ciP4ETHlz7
NyEbKNUsBBc20BteCvv51TKli5Ghod3bLk/0onpQsDmX8YzamIGGoQP9UOfxthr9
KwAjDZoy3pM=
=z3om
-----END PGP SIGNATURE-----