------------------------ 
     Amiga Virus Encyclopedia    
     D-Structure A/B/C-Virus
     ------------------------


     - D-Structure A/B/C-Virus
     
           Always at $7C000  oldOpenLib ALways $7C06E. Write always (-$30) 
           $7C0CC  not resident 
           Name: D-Structure is readable in the middle of the file.
           Type A: Filelength: 428 Bytes
           Type B: Filelength: 352 Bytes (Does often guru)  
           Type C: Filelength: 464 Bytes     (21.10.92)
                Type A and B :
          ffd24e75 0007c200 0007c204 442d5374 ..Nu........D-St
          72756374 75726500 c24033ee 000003ec ructure..@3.....
                Typ C:
          C2000007 C204442D 53747275 63747572 A...A.D-Structur
          65202000 000003F3 00000000 00000002 e  ....o........
            ^^^^                               ^^
               also with two more zeroes
           Executing:
         - allocabs $7C000
         - oldOpenlib is saved and hidden
         - when another program calls oldopenlib, a test is executed
           if the dos.library has to be opened. If not for example then
           intuition.lib.
         - newopenlib is executed and the D-Structure virus is waiting
           If yes: 
           - dosBase is saved
           - Org-Write is saved and hidden 
           - oldopenlib is reset
           - newopenlib is executed
           When the 5.th calling of write is executed, not only is the 
           virus written (in cli at the disk), but the virus is written
           at $7C000. This disk is damaged and not repairable.
         - The virus is not visible on the screen

           Recommendation: Immediately removal of the virus, and all the
           infected files and make check the startup-sequence.

           VT D-Structure A/B memory tested 09.09.92    
           VT D-Structure A/B finding the virus tested 09.09.92 
           VT D-structure C tested 21.10.92

           Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                    Kickstart all others: VirusZ III, and also Xvs.library must be installed


     Translated text from VT-Knows by Heiner Schneegold
     Translated by Torben Danoe