------------------------
     Amiga Virus Encyclopedia
     BlueBox Virus
     ------------------------


     Name         : BlueBox

     Aliases      : BlueBox (icon.library)

     Type/Size    : Bomb
     
     Size         : 5680 Bytes (PowerPacked)

     Clones       : No Clones

     Symptoms     : No Symptoms

     Discovered   : 16 july 1991

     Way to infect: File infection

     Rating       : Very Dangerous

     Kickstarts   : 1.2
                    1.3
                    2.0

     Damage       : Maybe damage for MODEM-Users.

     Manifestation: Pretends to be BLUEBOX-Hackprogram ?

     Comments     : If your`re starting the virus it tries to copy a fake
                    icon.library in your libs-directory. This fake lib is
                    6680 bytes long.

                    If another  programm  now  uses  this  fake library it
                    startes  a   prozess  with the  name  "input.device ".
                    Additionally  a  patch  in  $74  interrupt  will  be
                    installed. I don`t  know exactly what this patch does.
                    I think this Bomb  is used  to damage  special persons
                    (MODEM-Users !)

                    It`s really difficult to analyse Bombs which are used
                    to damage special persons...... I don`t have a MODEM.
                    This are the only facts I can say about this BlueBox.

     Removal      : Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                    Kickstart all others: VirusZ III with Xvs.library installed

     Test made by : Safe Hex International