JOEST@DD0RUD81.BITNET (Stephan Joest) (05/30/90)
Some days ago we detected another new effect on our machines.
The virus appeared at the first time here in Duesseldorf, West Germany.
Does anybody else around know these following facts:
- -- modified version of the German Keyboard driver KEYBGR.COM
for use with DOS 2.10
- -- Length changed from 1573 (original) bytes to 2013 (modified) bytes
date of modified version changed to June 6, 1989.
- -- After starting KEYBGR via AUTOEXEC (or later) a smile face
-ASCII 1- appears after a time of 2 minutes on the screen
and starts its random walk across the screen (one second per move)
- -- When going on a new screen position it replaces the character on
this position with the face and puts the original character on that
place where the face was one step ago.
If you are waiting a few minutes the screen is completely trashed.
- -- No printout of trashed screen is possible (Sorry, no example can
be shown here!); PrtSc only produces the original screen.
- -- No comment, no output text appears on the screen.
Looks like any other keyboard driver too.
- -- No other action known - seems that it is one of the harmless
viruses (i.e. no FAT or File destruction).
For discussion:
Although it looks like this is "only" a screen modifying program
I would be interested if the other subscribers of VIRUS-L think
that the group of programs to which this modified KEYBGR belongs
are viruses or not. My opinion about this is that I would call
it a virus just because of the fact that it replaces the
regular keyboard driver which is really part of the standard
programs one starts with every system boot.
Please tell me your suggestions (to me or to the list).
Yours,
Stephan Joest (JOEST at DD0RUD81.BITNET)