Article 21198 (6 more + 1 Marked to return)) in comp.sys.

amiga:
From: johnsen@daimi.dk (Henrik Johnsen)
Subject: IRQ Virus -it's out!!!
Keywords: Link Virus
Message-ID: <1885@daimi.dk>
Date: 28 Dec 88 16:45:05 GMT
Reply-To: johnsen@daimi.dk (Henrik Johnsen)
Organization: DAIMI: Computer Science Department, Aarhus University, Denmark
Lines: 22
A couple of weeks ago we received a disk from a member of the 68000 User
Group in Denmark, with at least one virus on it. This was the IRQ Link Virus
mentioned some time ago in this group. It is out and spreading, and we have
currently no cure for it. Symptoms are a title bar with text:
IRQ Presents another virus for the Amiga
On closer examination several programs (not the bootblock, it's OK)
were strange. BlitzFonts did not look like the original. We have used the
old (Fish 26) UnHunk program on these, and the code hunk of NewZap was very
small (<2kbytes), while the data hunk was large enough to contain the program
proper. It seems that the virus installs itself as the code hunk, and puts the
original program into a data hunk.
As we are no Execbase, disassembly, etc. gurus, we have sent copies of the
beast to Leonardo Fei (Guardian) and Steve Tibbet (VirusX) for examination.
And, BTW, software piracy in Denmark is not that bad. Everything is
available, if you want it, but we have not seen any BBS with significant
numbers of pirated programs. Belgium, Holland, and Germany are noted for
their crackers, and virus writers, IRQ is from Germany.
Henrik Clausen, hrc@daimi.dk, Henrik Johnsen, johnsen@daimi.dk
End of article 21198 (of 21204)--what next? [npq]