jaenichen@rz.informatik.uni-hamburg.dbp.de (Matthias Jaenichen) (03/18/91)
On the Hannover-fair "CeBit" a Virus-Construction-Set for MS-DOS was found in a BBS. The BBS is a German system called "ZERBERUS". The program was uploaded in Hamburg. The Box-Sysops are informed and will (hopefully) delete the entries. It is possible to build a virus that will display a massage at a selectable generation-count. At the same time the files "CONFIG.SYS" and "AUTOEXEC.BAT" will be deleted. The virus will be given the name "VCS-1.0". The virus extends programs by 1077 Bytes. The following string can be found at offset 50h:"A5 A5 A4 68 00 C1 C3 8A" At the end of the virus "C:\AUTOEXEC.BAT" and "C:\CONFIG.SYS" Codeanalysis will begin soon after the fair. - ---------------------------------------------------------------------------- Best wishes form Hamburg \\ // /==#==\ /==\ Matthias Jaenichen \\ // # / VTC-Hamburg \\// # # e-mail: jaenichen@rz.informatik.uni-hamburg.dbp.de \/ _#_ \==/ - ----------------------------------------------------------------------------