Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.csd.uwm.edu!uakari.primate.wisc.edu!ames!ncar!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: jwright@atanasoff.cs.iastate.edu (Jim Wright) Newsgroups: comp.virus Subject: New Amiga virus ? Message-ID: <0001.8909061523.AA21186@ge.sei.cmu.edu> Date: 4 Sep 89 16:41:39 GMT Sender: Virus Discussion List Lines: 60 Approved: krvw@sei.cmu.edu This was recently posted to comp.sys.amiga... In article <716@mathrt0.math.chalmers.se> d8forma@dtek.chalmers.se (Martin Fors sen) writes: | | Last night a friend called me, since he suspected he had a virus. | I gladly grabbed my copy of VirusX (3.20) and drove over, but VirusX | reported no virus. However I saw the text from the virus myself, and | a closer look at the diskette showed that the file c/addbuffers had grown, | furthermore a file with a blank name had appeared in devs. | | The main symptom of this virus is that every fourth time you reboots the tex t: | | A Computer virus is a disease | | Terrorism is a transgession | | Software piracy is a crime | | | this is the cure | | BGS9 Bundesgrensschutz sektion 9 | sonderkommando "EDV" | | | On this disk the virus had replaced the file c/addbuffers, the size of this | new file was 2608 bytes. The above text is encoded in the program, but the | string graphics.library can be found, maybe it's normal for addbuffers to ca ll | graphics.library :-) The orginal addbuffers command was stored in a "blank" | file in the devs directory. | The addbuffers command was the second in the startup sequence on this disk. | I think the virus looks in the startup-sequence for somthing (probably | files to infect), since I found the string sys:s/startup-sequence coded | in the virus. | I don't know if this virus does any damage, but the person first infected | hasn't noticed anything. | | | The questions I now ask me is: | | Is this a known virus? | | and if the answer is no, | | What is Steve Tibbets mail adress? | | | MaF | | Chalmers |USENET:d8forma@dtek.chalmers.se | " Of course I'm not lost, | University |SNAIL: Martin Forssen | I just haven't pinpointed | of | Marielundsgatan 9 | exactly where we are at the | Technology |SWEDEN 431 67 Molndal | moment " (David Eddings) - -- Jim Wright jwright@atanasoff.cs.iastate.edu