Name         : BlueBox

     Aliases      : No Aliases

     Type/Size    : Bomb/5680 (PowerPacked)

     Clones       : No Clones

     Symptoms     : No Symptoms

     Discovered   : 16-07-91

     Way to infect: File infection

     Rating       : Very Dangerous

     Kickstarts   : 1.2/1.3/2.0

     Damage       : Maybe damage for MODEM-Users.

     Manifestation: Pretends to be BLUEBOX-Hackprogram ?

     Removal      : Delete File immediately.

     Comments     : If your`re starting the virus it tries to copy a fake
                    icon.library in your libs-directory. This fake lib is
                    6680 bytes long.


                    If another  programm  now  uses  this  fake library it
                    startes  a   prozess  with the  name  "input.device ".
                    Additionally  a  patch  in  $74  interrupt  will  be
                    installed. I don`t  know exactly what this patch does.
                    I think this Bomb  is used  to damage  special persons
                    (MODEM-Users !)


                    It`s really difficult to analyse Bombs which are used
                    to damage special persons... I don`t have a MODEM.
                    This are the only facts I can say about this BlueBox.


     SHI - A.D 08-94

[Go back]