IRQ Presents another virus for the Amiga
A couple of weeks ago we received a disk from a member of the 68000 User Group in Denmark, with at least one virus on it. This was the IRQ Link Virus mentioned some time ago in this group. It is out and spreading, and we have currently no cure for it. Symptoms are a title bar with text:
IRQ Presents another virus for the Amiga
On closer examination several programs (not the bootblock, it's OK) were strange. BlitzFonts did not look like the original. We have used the old (Fish 26) UnHunk program on these, and the code hunk of NewZap was very small (<2kbytes), while the data hunk was large enough to contain the program proper. It seems that the virus installs itself as the code hunk, and puts the original program into a data hunk.
As we are no Execbase, disassembly, etc. gurus, we have sent copies of the beast to Leonardo Fei (Guardian) and Steve Tibbet (VirusX) for examination.
And, BTW, software piracy in Denmark is not that bad. Everything is available, if you want it, but we have not seen any BBS with significant numbers of pirated programs. Belgium, Holland, and Germany are noted for their crackers, and virus writers, IRQ is from Germany.
Henrik Clausen, hrc@daimi.dk, Henrik Johnsen, johnsen@daimi.dk
End of article 21198 (of 21204)--what next? [npq]
