New VirusX soon?
5 messages in this thread
Hi,
Has the new VirusX been posted yet? I'd like to take it to a rather large
user's group meeting in Columbus early Saturday$3@it shows up soon enough.
Will it wind up under Tools Lib? I checked there just now, but didn't find it.
(I'm not aware of how long it takes to get an UL posted.)
Thanks,
Karl
Karl, it's still not here – it will be merged as soon as it's uploaded and
tested. It will be in LIB 14 – we'll probably put it in an Announcement so
you'll see it when you log into the forum.
Marlene
Marlene,
Thanks. I wish I at least had a description of what the new virus looks
like; the only messages I've run across make comments like "this looks like the
one we've been dreading" without describing it. I have most likely missed an
earlier thread. What's most important is that it seems to be understood and
there is already a "detector" for it. Neato.
Karl
Karl,
I haven't seen the new virus, but I have read descriptions. It seems that the
IRQ virus first makes itself known by changing the title of your AmigaDOS
screen at bootup – changing the title to something that announces the name of
the IRQ virus itself. Another manifestation is that your software starts
growing by 1.1K as it attaches itself to various runnable commands or programs.
When we know more, we'll tell all.
Betty
The IRQ virus will only show it's name on the title bar about 3% of the
time. 50% of the time it will infect the C:DIR program, and 50% of the
time it will inspect your startup-sequence and infect the first program
found there.
Possible scenario:
– Download program from Wherever, which is infected.
– CD HardDisk:
– Run Program
– Virus loads into memory and sits there (doesn't do anything right
away, I don't think)
– Whenever you run a program which calls OldOpenLibrary() (which
some programs don't use at all), the virus hops into action.
– It will look at :C/DIR, and infect the DIR command on whatever
disk you are CD'ed to at the time, or it will look at
:S/Startup-sequence and infect the first program in it.
– Now, whenever you boot, the first line of your startup sequence
loads the virus into memory, and MAY show you it's name but probably
not.
There's really not much else to it than this. It doesn't do anything harmful
in it's current form, but as has been pointed out, having it reformat the
current disk every 50 boots would be a trivial addition.