Article View: comp.sys.mac
Article #35735Re: The NEW nVIR (just the facts, ma'am)
From: Bob LaserMan Murrow
Date: Wed, 21 Dec 1988 19:54
Date: Wed, 21 Dec 1988 19:54
26 lines
1225 bytes
1225 bytes
I have a new virus that may be the NEW nVir. The virus I got uploaded to my BBS PhoenixII at 408-252-3926 is of the type Hpat. It infects your SYSTEM file the first time it sees it. It is caught by Vaccine on boot but may be able to get by Vaccine if it is in a program that runs from a floppy. I modified a copy of RWatcher to catch it. It builds the following resourses: In an application: Hpat 1 size 428 Hpat 2 size 8 Hpat 3 size 416 Hpat 6 size 66 Hpat 7 size 2106 INIT 32 size 416 CODE 255 size 422 In your SYSTEM: Hpat 0 size 0 Hpat 1 size 428 Hpat 4 size 442 Hpat 5 size 8 Hpat 6 size 66 Hpat 7 size 2106 I am in the process of dissassembling this thing to see if it is going to be nasty. At first glance it appears to be only replicating itself and not doing damage. Bob Murrow laserman@cup.portal.com
Technical Details
Message-ID:
<12813@cup.portal.com>Path:
arc1-ca.pugleaf.net!utzoo!attcan!uunet!portal!cup.portal.com!LaserManReferences:
<4Xb0I9V28k-0A1zVwN@andrew.cmu.edu> <65@sdacs.ucsd.EDU>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!portal!cup.portal.com!LaserMan From: LaserMan@cup.portal.com (Bob LaserMan Murrow) Newsgroups: comp.sys.mac Subject: Re: The NEW nVIR (just the facts, ma'am) Message-ID: <12813@cup.portal.com> Date: 21 Dec 88 19:54:33 GMT References: <4Xb0I9V28k-0A1zVwN@andrew.cmu.edu> <65@sdacs.ucsd.EDU> Organization: The Portal System (TM) Lines: 26