Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: 8326442@AWIWUW11.BITNET (Martin Zejma)
Newsgroups: comp.virus
Subject: Inside the Whale-Virus (PC)
Message-ID: <0004.9106251509.AA25956@ubu.cert.sei.cmu.edu>
Date: 24 Jun 91 15:47:41 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 26
Approved: krvw@sei.cmu.edu

Hello virus-community |

About 2 month ago I got a (the) Whale-Virus from a friend, cause I've
been interested in dissasembling that famous monster ( just from the
size ).

After long nights of work I discovered almost all of the code, and it
seemed to be quite trivial , the unbelieveable mysterious actions I
expected to see didn't exist.

So the question is:
IS there ANY action triggered beside copying the MBR from the 1st
harddisk to a file appended with a warning message about the Fish #6
Virus and leaving some infected files destroyed ??? ( something like
the nice falling letters triggered by the Cascade Virus ?? )

                                          So long, Martin

PS.: if anybody wants more or less specific information about the Whale ,
     feel free to e-mail me.

+-----------------------------------------------------------------------+
| Martin Zejma                                8326442 @ AWIWUW11.BITNET |
|                                                                       |
| Wirtschaftsuniversitaet Wien  ---   Univ. of Economics Vienna/Austria |
+-----------------------------------------------------------------------+