jwright@atanasoff.cs.iastate.edu (Jim Wright) (09/04/89)
This was recently posted to comp.sys.amiga... In article <716@mathrt0.math.chalmers.se> d8forma@dtek.chalmers.se (Martin Fors sen) writes: | | Last night a friend called me, since he suspected he had a virus. | I gladly grabbed my copy of VirusX (3.20) and drove over, but VirusX | reported no virus. However I saw the text from the virus myself, and | a closer look at the diskette showed that the file c/addbuffers had grown, | furthermore a file with a blank name had appeared in devs. | | The main symptom of this virus is that every fourth time you reboots the tex t: | | A Computer virus is a disease | | Terrorism is a transgession | | Software piracy is a crime | | | this is the cure | | BGS9 Bundesgrensschutz sektion 9 | sonderkommando "EDV" | | | On this disk the virus had replaced the file c/addbuffers, the size of this | new file was 2608 bytes. The above text is encoded in the program, but the | string graphics.library can be found, maybe it's normal for addbuffers to ca ll | graphics.library :-) The orginal addbuffers command was stored in a "blank" | file in the devs directory. | The addbuffers command was the second in the startup sequence on this disk. | I think the virus looks in the startup-sequence for somthing (probably | files to infect), since I found the string sys:s/startup-sequence coded | in the virus. | I don't know if this virus does any damage, but the person first infected | hasn't noticed anything. | | | The questions I now ask me is: | | Is this a known virus? | | and if the answer is no, | | What is Steve Tibbets mail adress? | | | MaF | | Chalmers |USENET:d8forma@dtek.chalmers.se | " Of course I'm not lost, | University |SNAIL: Martin Forssen | I just haven't pinpointed | of | Marielundsgatan 9 | exactly where we are at the | Technology |SWEDEN 431 67 Molndal | moment " (David Eddings) - -- Jim Wright jwright@atanasoff.cs.iastate.edu