~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Destructive New Virus! AR Emergency Press Release ================================================== By Michael Arends, SHI Regional Virus Center/West Editor's Note: We received this package a few hours too late to get it into Amiga Report #1.12. Due to the urgent nature of this information, we have decided to release it now, rather than wait for the next issue. - Rob @ AR *** POST THIS MESSAGE EVERYWHERE THAT YOU CAN! *** THE MESSAGE THAT FOLLOWS contains some profanity, However, Due to the contents of the message, and the Very Important nature of this Subject for ALL amiga users, it (the profanity) has been left intact. Please read it and I am gravely sorry if it(the profanity) offends anyone. BUT, being a Regional center for SHI, I felt it was my duty to pass this info along to everyone in this matter. The message was originally posted by Luca Spada comming from Europe.. Michael Arends SHI RVC/West P.O. Box 1531 LynnWood, WA 98046-1531 ************************************************************ Date: 30 May 93 10:25:15 From: Luca Spada To: All Subj: VIRUS VIRUS VIRUS VIRUS !!!!!!!!!! ***** PLEASE READ * VERY IMPORTANT ***** A new blasted virus is spreading around in the Amiga comunity... you can call it the "FUCK virus"... SkyLink has been almost DESTROYED by it... WHAT IS?? There is around a program called ModemChecker (contained in MCHECK.LHA) that should test the modem connected to an Amiga, but it's a fake. It always says "OK OK" even if you don't have a modem attached. This program installs in memory the virus that keeps under control the keyboard. If you don't touch the keyboard for 5-10 mins (so you have gone away) it starts WRITING ON ALL YOUR HD PARTITIONS "FUCKFUCKFUCK" ALL OVER THE TRACKS RANDOMLY!! Destroying everything on ALL your hard disks in 30 seconds. It's VERY VERY FAST. It reduces all your partition to "Not a DOS Disk" in almost 4 seconds. You can restore some files (50% in my case) with QuarterBack Tools, but of these files, 90% contained "FUCKFUCKFUCK... etc"... executable files gurued, and data/text files was so corrupted that I had to deleted them... and like that for ALL the partition... it pratically writes 20 sectors of FUCK, leave 3 OK, 20 sectors of FUCK, etc... but sometimes writes more sectors of FUCK... it seems random... but you can stay SURE that everything you had on your HardDisks in TOTALLY AND COMPLETLY LOST!!!!!!!!!!!!!!!!!!! But I have not taken the virus from MCHECK.LHA... I think I have taken it from some other files... I was testing some new programs for hatching them in SAN... after that I left the Amiga alone for having dinner and when I was back the "FUCK virus" already destroyed everything. So it can be a link virus, but I'm not sure... SkyLink is now half-destroyed... almost all files has been lost, but I can restore them thanks to SAN. It's now MAIL-ONLY, if you are a my downlink, please use SkyAF to see if you are connected to all the areas. I have rescued some *.cfg (stripping off the FUCKs) but something has been lost. Folks, WATCH OUT FOR THIS VIRUS!! IT'S A REAL CURSE! A lot of people are already analyzing the virus... I will keep you informed... the virus seems native from Europe (should have max 10 days of life), PLEASE SPREAD THE WORD EVERYWHERE or this virus will destroy everyone! Ciao! Sky Luke ------------------------------ From : Michael Arends SHI Regional Virus center, Washington state ------------------------------------------------------------------ HERE IS MORE INFO on the new F..k Virus, mentioned in the last text I submitted to AR... Quoting Luca Spada (2:331/106.0) to All: From a message on Fidonet LS> But I have not taken the virus from MCHECK.LHA... I think I have LS> taken it from some other files... I was testing some new programs LS> for hatching them in SAN... after that I left the Amiga alone for LS> having dinner and when I was back the "FUCK virus"already destroyed LS> everything. So it can be a link virus, but I'm not sure... This info was taken from a local BBS here: "Modemcheck.doc" 2227 Bytes "Modemchecker" 15516 Bytes This is another lame Trojan Horse!!!! I just examined the "ModemChecker", after depacking it, I recognized the word "SnoopDos" in the Code. Hmm ?? Yep! If you're running SnoopDos in the Backround to check if this is a Virus, it kicks it out! Ha! So I just took my own SnoopDos (not released due to some bugs,but even more effective, hehe) and watched what will happen ... Hmm ? A -NEW- "c/loadwb" will be created, with 3604 Bytes! If you now start this new 'LoadWB' the System will act like normally, but after some minutes you'll recognize that something starts to erase your HD/Floppy. Pah! So stop spreading this kind of Crap-Tool, and beware of starting it! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~