Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!ames!amdcad!sun!pitstop!sundc!seismo!uunet!mcvax!ukc!tcdcs!vax1!rwallace
From: rwallace@vax1.tcd.ie
Newsgroups: comp.sys.amiga
Subject: IRQ Virus
Message-ID: <34280@vax1.tcd.ie>
Date: 21 Feb 89 16:39:19 GMT
Organization: Computer Laboratory, Trinity College Dublin
Lines: 24

DON'T PANIC!
The dreaded IRQ virus is apparently virtually harmless.
It does not survive reboot.
It does not infect every program you load in.
It looks at the first line in :S/STARTUP_SEQUENCE.
If that's an executable program it infects it. Otherwise it infects :C/DIR.
It does this every time OldOpenLibrary() is called. In effect this means
that whenever you run any program the virus may look at the first item in
your startup-sequence and :C/DIR on whatever disk you currently have in the
drive, so it can spread very slowly from disk to disk. It does no deliberate
damage.
Stopping it is simple. Rename C/DIR to something else e.g. move it into a
different directory, rename it to DI or delete it and use a command shell's
built-in DIR command instead. And put a tab character before the program
name on the first line of your startup-sequence.
I can't be certain of any of this because I haven't seen the virus myself,
I got this information from articles on Jumpdisk. Also somebody may mutate
it into something much more virulent at a later date. But at the moment
it seems we don't have to worry too much. The new version of VirusX and a
program called KillVirus will also specifically detect it.

"To summarize the summary of the summary: people are a problem"
Russell Wallace, Trinity College, Dublin
rwallace@vax1.tcd.ie