Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!tut.cis.ohio-state.edu!ucsd!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: munnari!cavs.syd.dwt.oz.au!johng@uunet.UU.NET (John Gardner)
Newsgroups: comp.virus
Subject: Re: Linkable virus modules
Message-ID: <0004.8912051652.AA01999@ge.sei.cmu.edu>
Date: 4 Dec 89 04:17:15 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 19
Approved: krvw@sei.cmu.edu

IA96@PACE.BITNET (IA96000) writes:
>1) A new or existing virus is developed and produced as a linkable
>   object file.
>
>2) Said object file is then either directly linked into an executable
>   file at link time, or placed in a run-time library.

There is a virus on the amiga that looks for an executable that is in the
startup batch file and moves the executable`s code into a data segment and
inserts itself into the code segment.  If it can't find the startup file
it then inserts itself into the dir command.  It is easy to spot as one
of your commands changes size, and you just have to delete that command to
kill it.

- --
PHONE          : (02) 436 3438
ACSnet         : johng@cavs.dwt.oz

"But that wasn't the question !" - Do Androids Dream Of Electric Sheep