Name         : Detlef

     Aliases      : No Aliases

     Type/Size    : Boot/1024

     Clones       : No Clones 

     Symptoms     : No Symptoms

     Discovered   : 12-09-93

     Way to infect: Boot infection

     Rating       : Harmless

     Kickstarts   : 1.2/1.3/2.0 (Only DD-Disks)

     Damage       : Overwrites boot.

     Removal      : Install boot.

     Comments     : The Detlef-Virus is a harmless one. It copies  itself
                    to a  CHIP-Memory-Area which was  first  allocated by
                    the virus. The DoIO()  vector is used to infect other
                    disks  and to stay  resident in memory the virus uses
                    the KICKVectors which will be manipulated.


                    The  DOIO()-Check routine is  a little  bit bad coded
                    because the virus test for block 880. Because of this
                    fact it`s very unlikely that the virus infects 
                    HD-Disks (BUT NOT UNTHINKABLE!). The  whole bootblock
                    is crypted  depending of  $dff00a.  Sometimes while a
                    Reset the virus gives out this ALERT:

                                        "Guten Tag."
                                   "» Ich heiße DETLEF «"
                      "Ich werde Sie in der nächsten Zeit etwas nerven"
                            "Gemacht wurde ich von     M A X    "



     SHI - A.D 08-94

[Go back]