Article View: comp.virus
Article #4606Inside the Whale-Virus (PC)
From: Martin Zejma
Date: Mon, 24 Jun 1991 15:47
Date: Mon, 24 Jun 1991 15:47
26 lines
1655 bytes
1655 bytes
Hello virus-community |
About 2 month ago I got a (the) Whale-Virus from a friend, cause I've
been interested in dissasembling that famous monster ( just from the
size ).
After long nights of work I discovered almost all of the code, and it
seemed to be quite trivial , the unbelieveable mysterious actions I
expected to see didn't exist.
So the question is:
IS there ANY action triggered beside copying the MBR from the 1st
harddisk to a file appended with a warning message about the Fish #6
Virus and leaving some infected files destroyed ??? ( something like
the nice falling letters triggered by the Cascade Virus ?? )
So long, Martin
PS.: if anybody wants more or less specific information about the Whale ,
feel free to e-mail me.
+-----------------------------------------------------------------------+
| Martin Zejma 8326442 @ AWIWUW11.BITNET |
| |
| Wirtschaftsuniversitaet Wien --- Univ. of Economics Vienna/Austria |
+-----------------------------------------------------------------------+
Technical Details
Message-ID:
<0004.9106251509.AA25956@ubu.cert.sei.cmu.edu>Path:
arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvwShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: 8326442@AWIWUW11.BITNET (Martin Zejma) Newsgroups: comp.virus Subject: Inside the Whale-Virus (PC) Message-ID: <0004.9106251509.AA25956@ubu.cert.sei.cmu.edu> Date: 24 Jun 91 15:47:41 GMT Sender: Virus Discussion List <VIRUS-L@LEHIIBM1> Lines: 26 Approved: krvw@sei.cmu.edu