Translated text from VT-Knows by Heiner Schneegold -------------------------------------------------- - D-Structure A/B/C-Virus Always at $7C000 oldOpenLib ALways $7C06E. Write always (-$30) $7C0CC not resident Name: D-Structure is readable in the middle of the file. Type A: Filelength: 428 Bytes Type B: Filelength: 352 Bytes (Does often guru) Type C: Filelength: 464 Bytes (21.10.92) Type A and B : ffd24e75 0007c200 0007c204 442d5374 ..Nu........D-St 72756374 75726500 c24033ee 000003ec ructure..@3..... Typ C: C2000007 C204442D 53747275 63747572 A...A.D-Structur 65202000 000003F3 00000000 00000002 e ....o........ ^^^^ ^^ also with two more zeroes Executing: - allocabs $7C000 - oldOpenlib is saved and hidden - when another program calls oldopenlib, a test is executed if the dos.library has to be opened. If not for example then intuition.lib. - newopenlib is executed and the D-Structure virus is waiting If yes: - dosBase is saved - Org-Write is saved and hidden - oldopenlib is reset - newopenlib is executed When the 5.th calling of write is executed, not only is the virus written (in cli at the disk), but the virus is written at $7C000. This disk is damaged and not repairable. - The virus is not visible on the screen Recommendation: Immediately removal of the virus, and all the infected files and make check the startup-sequence. VT D-Structure A/B memory tested 09.09.92 VT D-Structure A/B finding the virus tested 09.09.92 VT D-structure C tested 21.10.92 Translated by Torben Danoe [Go back]