37 lines
1.9 KiB
Plaintext
37 lines
1.9 KiB
Plaintext
Article 21198 (6 more + 1 Marked to return)) in comp.sys.amiga:
|
||
From: johnsen@daimi.dk (Henrik Johnsen)
|
||
Subject: IRQ Virus -it's out!!!
|
||
Keywords: Link Virus
|
||
Message-ID: <1885@daimi.dk>
|
||
Date: 28 Dec 88 16:45:05 GMT
|
||
Reply-To: johnsen@daimi.dk (Henrik Johnsen)
|
||
Organization: DAIMI: Computer Science Department, Aarhus University, Denmark
|
||
Lines: 22
|
||
|
||
A couple of weeks ago we received a disk from a member of the 68000 User
|
||
Group in Denmark, with at least one virus on it. This was the IRQ Link Virus
|
||
mentioned some time ago in this group. It is out and spreading, and we have
|
||
currently no cure for it. Symptoms are a title bar with text:
|
||
|
||
IRQ Presents another virus for the Amiga
|
||
|
||
On closer examination several programs (not the bootblock, it's OK)
|
||
were strange. BlitzFonts did not look like the original. We have used the
|
||
old (Fish 26) UnHunk program on these, and the code hunk of NewZap was very
|
||
small (<2kbytes), while the data hunk was large enough to contain the program
|
||
proper. It seems that the virus installs itself as the code hunk, and puts the
|
||
original program into a data hunk.
|
||
|
||
As we are no Execbase, disassembly, etc. gurus, we have sent copies of the
|
||
beast to Leonardo Fei (Guardian) and Steve Tibbet (VirusX) for examination.
|
||
|
||
And, BTW, software piracy in Denmark is not that bad. Everything is
|
||
available, if you want it, but we have not seen any BBS with significant
|
||
numbers of pirated programs. Belgium, Holland, and Germany are noted for
|
||
their crackers, and virus writers, IRQ is from Germany.
|
||
|
||
Henrik Clausen, hrc@daimi.dk, Henrik Johnsen, johnsen@daimi.dk
|
||
|
||
End of article 21198 (of 21204)--what next? [npq]
|
||
|
||
|