........................... VIRUS HELP DENMARK ..........................
Hi All.... 29.11.97
A new link-virus has been spread the last days. At this time no viruskiller
is abel to find and kill this sucker. The virus has been send to all the
major AntiVirus programmers, so it is only a matter of time, before the
viruskillers can find and remove this 'sucker'.
There is no known program or archive that spreads this new virus. All that
we know of this new virus, is that it will add 1260 bytes to all programs
that is executed. And with in these 1260 bytes that is added you can read
"TRSi".
Well, I don't think that TRSi has anything to do with this.
As soon as a killer is released that will kill this virus, we will let you
know so check your contacts or our homepage.
Heiner Schneegold, programmer of VT has made a quick test of this sucker,
and here is what he found out:
ZIB-Virus
verbogener Vektor: Loadseg
LastAlert: "TRSi"
Eigener Process: ZIB
Fileverlaengerung: #1260 Bytes
Link hinter 1.Hunk
RTS wird in bra.s umgewandelt
falls bsdsocket.lib vorhanden, Veraenderungen
Well, this is all we know for now.
After we wrote the warning, a few killers has been updated so the they will
be abel to find and kill this "ZIB" virus.
VT v3.01 (30.11.97) - Heiner Schneegold
FastVirusKiller v1.12 (29.11.97) - By Dave Jones
AntiBeol v1.34a (29.11.97) - By Gideon Zenz
KillAnother v1.00 (29.11.97) - By Harry Sintonen
You can download these killers from our homepage or support BBS.
Thanx to Dave Jones, Harry Sintonen and Jakob Anderson for sending this new
virus to us. It is on it's way to all major antivirus programmers.
Regards....
__ Jan Andersen E-Mail..: jan@vht-dk.dk
__ /// -------------- FidoNet.: 2:237/38.100
\\\/// Virus Help Team Denmark AmyNet..: 39:140/127.100
\XX/ http://www.vht-dk.dk VirNet..: 9:451/247.0
