RY15%DKAUNI11.BITNET@IBM1.CC.Lehigh.Edu (Christoph Fischer) (11/14/89)
Hi, VACSINA infects any file that is loaded and executed via the INT 21H(4BH) function. So additionally to COM and EXE files other files like OVL or APP are infected as long as they start with E9H (jump) or 'MZ' (EXE header). We have written a program that detects VACSINA and removes it from those files. Also we have an immuniser that prevents VACSINA from installing its memory resident copy. Christoph and Torsten ***************************************************************** * Torsten Boerstler and Christoph Fischer and Rainer Stober * * Micro-BIT Virus Team / University of Karlsruhe / West-Germany * * D-7500 Karlsruhe 1, Zirkel 2, Tel.: (0)721-608-4041 or 2067 * * E-Mail: RY15 at DKAUNI11.BITNET or RY12 at DKAUNI11.BITNET * *****************************************************************