 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

> Destructive New Virus!  AR Emergency Press Release
  ==================================================
  By Michael Arends, SHI Regional Virus Center/West 


Editor's Note:  We received this package a few hours too late to get it into
Amiga Report #1.12.  Due to the urgent nature of this information, we have
decided to release it now, rather than wait for the next issue.  - Rob @ AR

            *** POST THIS MESSAGE EVERYWHERE THAT YOU CAN! ***

 
            THE MESSAGE THAT FOLLOWS contains some profanity,
   However, Due to the contents of the message, and the Very Important
nature of this Subject for ALL amiga users, it (the profanity) has been
left intact. Please read it and I am gravely sorry if it(the profanity)
offends anyone. BUT, being a Regional center for SHI, I felt it was my
duty to pass this info along to everyone in this matter. The message was
originally posted by Luca Spada comming from Europe..

                          Michael Arends
                          SHI RVC/West
                          P.O. Box 1531
                          LynnWood, WA  98046-1531
 
       ************************************************************ 
Date: 30 May 93  10:25:15 
From: Luca Spada 
  To: All 
Subj: VIRUS VIRUS VIRUS VIRUS !!!!!!!!!! 
 
                 ***** PLEASE READ * VERY IMPORTANT *****  
  
A  new  blasted virus is spreading around in the Amiga comunity...  you can  
call it the "FUCK virus"...  SkyLink has been almost DESTROYED by it...  
  
WHAT IS??  
  
There  is  around  a  program called ModemChecker (contained in MCHECK.LHA)  
that  should  test  the  modem  connected to an Amiga, but it's a fake.  It  
always  says "OK OK" even if you don't have a modem attached.  This program  
installs in memory the virus that keeps under control the keyboard.  If you
don't  touch the keyboard for 5-10 mins  (so you have gone away) it  starts
WRITING  ON  ALL  YOUR HD  PARTITIONS "FUCKFUCKFUCK" ALL  OVER  THE  TRACKS  
RANDOMLY!!   Destroying  everything  on  ALL your hard disks in 30 seconds.  
It's  VERY VERY FAST.  It reduces all your partition to "Not a DOS Disk" in  
almost 4 seconds.  
  
You  can restore some files (50% in my case) with QuarterBack Tools, but of  
these  files,  90%  contained  "FUCKFUCKFUCK...   etc"...  executable files  
gurued, and data/text files was so corrupted that I had to deleted them...  
and  like that for ALL the partition...  it pratically writes 20 sectors of  
FUCK,  leave  3  OK,  20  sectors of FUCK, etc... but sometimes writes more 
sectors  of  FUCK...   it  seems  random...   but  you  can  stay SURE that  
everything   you   had   on   your   HardDisks  in  TOTALLY  AND  COMPLETLY  
LOST!!!!!!!!!!!!!!!!!!!  
  
But  I have not taken the virus from MCHECK.LHA...  I think I have taken it  
from some other files...  I was testing some new programs for hatching them  
in  SAN...   after that I left the Amiga alone for having dinner and when I  
was  back  the  "FUCK  virus" already destroyed everything.  So it can be a  
link virus, but I'm not sure...  
  
SkyLink is now half-destroyed...  almost all files has been lost, but I can  
restore them thanks to SAN.  
It's  now  MAIL-ONLY,  if you are a my downlink, please use SkyAF to see if  
you are connected to all the areas.  
  
I  have rescued some *.cfg (stripping off the FUCKs) but something has been  
lost.  
         Folks, WATCH OUT FOR THIS VIRUS!!  IT'S A REAL CURSE!  
  
A  lot  of  people  are  already  analyzing  the  virus...  I will keep you  
informed...  the virus seems native from Europe (should have max 10 days of  
life),
    PLEASE SPREAD THE WORD EVERYWHERE or this virus will destroy everyone!  
  
Ciao!  
                                                   Sky Luke  



                      ------------------------------



  From : Michael Arends   SHI Regional Virus center, Washington state
   ------------------------------------------------------------------
    HERE IS MORE INFO on the new F..k Virus, mentioned in the last
  text I submitted to AR...


Quoting Luca Spada (2:331/106.0) to All: From a message on Fidonet
 
 LS> But  I have not taken the virus from MCHECK.LHA...  I think I have 
 LS> taken it from some other files...  I was testing some new programs 
 LS> for hatching them in  SAN...   after that I left the Amiga alone for 
 LS> having dinner and when I was  back  the  "FUCK  virus"already destroyed
 LS> everything.  So it can be a link virus, but I'm not sure... 
 
This info was taken from a local BBS here: 
 
 "Modemcheck.doc"    2227 Bytes 
 "Modemchecker"     15516 Bytes 
  
 This is another lame Trojan Horse!!!! I just examined the "ModemChecker",
 after depacking it, I recognized the word  "SnoopDos" in the Code. Hmm ??
 Yep! If you're running SnoopDos in the Backround to check if this is a
 Virus, it kicks it out! Ha! So I just took my own SnoopDos (not released
 due to some bugs,but even more effective, hehe) and watched what will
 happen ... Hmm ? A -NEW- "c/loadwb" will be created, with 3604 Bytes!
 If you now start this new 'LoadWB' the System will act like normally,
 but after some minutes you'll recognize that something starts to erase
 your HD/Floppy. Pah! So stop spreading this kind of Crap-Tool, and beware
 of starting it!  


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
