Amiga Virus Encyclopedia
- D-Structure A/B/C-Virus
Always at $7C000 oldOpenLib ALways $7C06E. Write always (-$30)
$7C0CC not resident
Name: D-Structure is readable in the middle of the file.
Type A: Filelength: 428 Bytes
Type B: Filelength: 352 Bytes (Does often guru)
Type C: Filelength: 464 Bytes (21.10.92)
Type A and B :
ffd24e75 0007c200 0007c204 442d5374 ..Nu........D-St
72756374 75726500 c24033ee 000003ec ructure..@3.....
C2000007 C204442D 53747275 63747572 A...A.D-Structur
65202000 000003F3 00000000 00000002 e ....o........
also with two more zeroes
- allocabs $7C000
- oldOpenlib is saved and hidden
- when another program calls oldopenlib, a test is executed
if the dos.library has to be opened. If not for example then
- newopenlib is executed and the D-Structure virus is waiting
- dosBase is saved
- Org-Write is saved and hidden
- oldopenlib is reset
- newopenlib is executed
When the 5.th calling of write is executed, not only is the
virus written (in cli at the disk), but the virus is written
at $7C000. This disk is damaged and not repairable.
- The virus is not visible on the screen
Recommendation: Immediately removal of the virus, and all the
infected files and make check the startup-sequence.
VT D-Structure A/B memory tested 09.09.92
VT D-Structure A/B finding the virus tested 09.09.92
VT D-structure C tested 21.10.92
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III, and also Xvs.library must be installed
Translated text from VT-Knows by Heiner Schneegold
Translated by Torben Danoe