amiga-news.de - Virus Help Denmark: two new viruses discovered

08.Dec.2001
Jan Andersen (ML) Virus Help Denmark: two new viruses discovered
1.
Two archives found on Aminet contain a new trojan. They are said to be AGA demos but if you run these demos on a PC using 'WinUAE' your system will be deleted. These demos come from a Polish demo group. Why they would program something like this, I don't know.

This is some info about the two archives:

Trojan name... : AME-DSD Trojan (name might be changed later)
Trojan file... : dsd-main
Trojan size... : 93.924 bytes
Trojan archive : AME-DSD.lha
Archive size.. : 6.927.166 bytes
Archive info.. : Dog Star Descends by Amnesty (CGX&AHI compatible)

Trojan name... : PSL-KMJ Trojan (name might be changed later)
Trojan file... : main
Trojan size... : 49.308 bytes
Trojan archive : PSL-KMJ.lha
Archive size.. : 5.530.365 bytes
Archive info.. : Kiss My Jazz by Pic Saint Loup (AGA/CGX)

In the code for these archives you can read:

------------ Code start -----------------------

Warning!!! UAE System for lamers detected!!! - System will reboot after mouse button... run c:delete s:startup-sequence force quiet >NIL:

------------ Code end -------------------------

It is not legal to release destructive programs to the public, and we will see what we can do with this. In almost every country the programmer of such destructive programs can go to jail for this kind of programming.

The xvs.library package will be released very soon.....

Thanks to 'Urban' for the info about the archive.

2.
A new linkvirus has been found a few days ago, we are not sure if this virus is in the wild. It was send directly to Zbigniew Trzcionkowski (the programmer of Safe). Zbigniew received one infected file. This new virus is a clone of the "Bobek-2" linkvirus and is named "Bobek-3". This is able to disable the antivirus programs.

We do not know if this virus was released in any way, so if you get a requester popping up, telling you that something is trying to disable the xvs.library, please let us know.

This is what we know of the virus:

Virus name: Bobek-3
Virus Type: Linkvirus
Virus size: about 2.000 bytes (uses polmorphic engine)

Well, it looks like the Polish virus group is back in action. But maybe not for long. Things will happen very soon.

Thanks to 'Zbigniew' for sending the archive. (ps)

[News message: 08. Dec. 2001, 13:00] [Comments: 0]
[Send via e-mail] [Print version] [ASCII version]

< Next message

Prior message >