Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.csd.uwm.edu!gem.mps.ohio-state.edu!ginosko!uunet!mcsun!sunic!chalmers!mathrt0.math.chalmers.se!hacke8!d8forma
From: d8forma@dtek.chalmers.se. (Martin Forssen)
Newsgroups: comp.sys.amiga
Subject: New virus ?
Message-ID: <716@mathrt0.math.chalmers.se>
Date: 4 Sep 89 14:21:13 GMT
Sender: news@mathrt0.math.chalmers.se
Reply-To: d8forma@dtek.chalmers.se (Martin Forssen)
Organization: Chalmers Univ. of Technology, Gothenburg, Sweden
Lines: 50


 Last night a friend called me, since he suspected he had a virus.
 I gladly grabbed my copy of VirusX (3.20) and drove over, but VirusX
 reported no virus. However I saw the text from the virus myself, and
 a closer look at the diskette showed that the file c/addbuffers had grown,
 furthermore a file with a blank name had appeared in devs.

 The main symptom of this virus is that every fourth time you reboots the text:

		   A Computer virus is a disease

		    Terrorism is a transgession

		    Software piracy is a crime


		         this is the cure

		BGS9  Bundesgrensschutz sektion 9
		      sonderkommando "EDV"

 
 On this disk the virus had replaced the file c/addbuffers, the size of this
 new file was 2608 bytes. The above text is encoded in the program, but the
 string graphics.library can be found, maybe it's normal for addbuffers to call
 graphics.library :-)  The orginal addbuffers command was stored in a "blank"
 file in the devs directory.
 The addbuffers command was the second in the startup sequence on this disk.
 I think the virus looks in the startup-sequence for somthing (probably
 files to infect), since I found the string sys:s/startup-sequence coded
 in the virus.
 I don't know if this virus does any damage, but the person first infected
 hasn't noticed anything.


 The questions I now ask me is:

 Is this a known virus?

 and if the answer is no,

 What is Steve Tibbets mail adress?


							MaF

  Chalmers  |USENET:d8forma@dtek.chalmers.se | " Of course I'm not lost,
 University |SNAIL:  Martin Forssen          |   I just haven't pinpointed
     of     |        Marielundsgatan 9       |   exactly where we are at the
 Technology |SWEDEN  431 67 Molndal          |   moment " (David Eddings)