amiga-news.de - VirusHelp Denmark: Virus Warning

20.Dec.2000
Jan Andersen via eMail VirusHelp Denmark: Virus Warning
Today we received a new 'lame' trojan. This trojan will only execute it self if you have named your hard-disk "DH0" & "DH1". The trojan is spread in and archive with the name "DKG-BLUM.LHA". If you run the "DKG-BLUM.exe", the trojan will replace your c:loadwb with another loadwb (size: 3560 bytes) and replace c:assign with another assign (size: 2408 bytes), and the screen will tell you that there is not enough memory, and you will have to restart, then it looks like the trojan will delete DH1:.
The trojan also adds or replaces 2 other files, "LIBS:asi.library" & "DEVS:ASI.device".

The cure right now (If you have lost your DH1: to bad......), then replace the trojan files with clean ones, here is the trojan sizes:

c:loadwb ( 3560 bytes) c:assign ( 2408 bytes) libs:asi.library (24548 bytes - delete if you dont have clean file) devs:asi.device ( 2408 bytes - delete if you dont have clean file)

Here is some info about the infected archive:

Virus Type.... : Trojan
Archive name.. : dkg-blum.lha
Archive size.. : 28.535 bytes (lha packet)

This archive has been send to all the antivirus programers.....

Thanx to Peter Gordon & Urban for the info and sending the archive to us........

[News message: 20. Dec. 2000, 01:04] [Comments: 0]
[Send via e-mail] [Print version] [ASCII version]

< Next message

Prior message >