brunnstein@rz.informatik.uni-hamburg.dbp.de (Klaus Brunnstein) (03/21/91)
Original-From: jaenichen@rz.informatik.uni-hamburg.dbp.de (Matthias Jaenichen)
"Virus-Test-Center University of Hamburg"
!!!!!!!!!!!!!!!!!!!!!! Update Update Update Update !!!!!!!!!!!!!!!!!!!!!!!!!
Virus: "VCS-1.0" (Virus Construction Set Virus 1.0)
As we resently found out, the virus uses a self encryption-method.
The string at 50h and the two filenames are encrypted.
The ***updated search pattern*** is:
"E8 14 00 8a a4 2f 05 8d bc"
Plain text can not be found.
BtW: meanwhile, we received a copy from abroad where it was uploaded
from tbe BBS; moreover, several people have informed us, at Hannover
fair, about this incidebnt. We therefore assume that the virus may
spread further. More information (esp. Virus Catalog entry) will be
available after completion of reverse engineering; information will be
passed to Virus-L. Klaus Brunnstein
!!!!!!!!!!!!!!!!!!!!!!!! Update Update Update !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
- ----------------------------------------------------------------------------
Best wishes form Hamburg \\ // /==#==\ /==\
Matthias Jaenichen \\ // # /
VTC-Hamburg \\// # #
e-mail: jaenichen@rz.informatik.uni-hamburg.dbp.de \/ _#_ \==/
- ----------------------------------------------------------------------------