ConMan Dir Virus:
        -----------------


        Filelength: 4004 bytes (using TurboSqueeze 6.1)
                    8456 bytes unpacked



        This virus creates a new process with the name  "Workbench ". It
        writes a new Dir Command and tries to damage several other files
        (L:RAM-Handler,Devs:System-Configuration,C:Loadwb).

        No spreading was possible on  a  normal (not accelerated) A500+.
        On an AMIGA 4000/40 the virus could be started and wrote  a  new
        dircommand. The virus does not work  with activated  caches.  It
        will simply crash.

        VirusWorkshop removes the process NOT. It simply  fills  up  the
        whole process with "RTS". Sorry guys. I have tried to remove the
        task, but after some crashes  (mainly  on  slower  machines),  I
        stopped this project.

        The virus will sometimes display an alert  and  after  you  have
        pressed a  mousebutton, the value $fa0 will be  written  to  the
        interrupt  enable register. All disk/keyboard  actions  will  be
        disabled.




        Alerttext:
        ----------

      THIS IS NOT A SYSTEM ALERT! THIS IS THE NEW CONMAN-TROJAN VIRUS


                    ALL DISK ACTIVITIES WILL BE DISABLED!

  GREETINGS TO JOE/DEFJAM BRUCE/DEFJAM  NATAS/DEFJAM ALEX/DEFJAM AND DOC!



  CONTACT ME xxx-xxx-xx-xx USR 14.4 NO STUFF! ONLY VIRUS-PROGRAMMER AREA!





  Test by Markus Schmall                  Detection tested 30.03.1994.
                                       Ramdetection tested 31.03.1994.


[Go back]