How the user usually deals with Commander
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The  first  wierd thing according to the user is that suddenly some of his
programs  won't  work  and/or  the  memory  isn't set free after running a
program  has reserved it.  Also some ASCII-chars in the WB-title-bar looks
a  bit  different  (like:   all  '0' is replaced with 'Ò' and wierd pixels
appear in the top line of some chars).


When  the  user  tries  to  find  out  what  is  going on, getting maybe a
directory   either  by  using  the  "Dir"  command  from  CLI  or  running
DirectoryOpus,  everything  will  seem normal, but - if the user is really
paying  attention  -  the  size of free space on his HD.  Depending on how
long  mysterious  things  has  been going on, the empty room on the HD has
gone smaller!


At  this  time  the  user may have guessed that a virus has taken over the
control.   If not he'll probably try running some disk-repair-tool, and he
will  find  that  his  Amiga freezes during the process.  Afterwards he'll
possibly run a virus-killer and depending on the extensiveness of it, this
will either produce no result or the solution.  If not...


'Panic'  is now written in the users mind (if he hasn't recently backed up
his  HD).   In  frustration  of  nothing  else to do he'll perhaps use the
command:   'List'  and  find strang ':  ' in the dirs right underneath the
executable  programs  he  has recently run.  The ':  ' means that the file
listed just above has the comment ' ' (a single space).  It may also accur
to  the  user  that all the files having this wierd comment has grown 1664
bytes  longer.   And maybe 2 or 3 boots later not only almost all files in
the C dir.  but also other exe-files (maybe never run) is infected!!



As far as I know the Commander-virus does following things:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
When active the memory reserved by the executed prg.'s is not released.


It  infects all (by the user, - not necessarily from the Startup-sequence)
executed  files  (e.g.   the 'Dir' command), - later it also infects files
not run.


'Infects' means:
  When  executing  a file (and Commander is active - in memory), the virus
links with the size 1664 bytes to the file, thereby making itself executed
(if  not  already active) next time the infected file is run (copying this
single  file  to your friends disk and inserting it in his Amiga is enough
to make his life a nightmare!).  Commander deletes the existing comment on
the file and puts in a singele space (' ') instead.



Notes:
~~~~~~
Wether  it  is  software-destructive or not I don't know.  The only things
seeming   somehow   affecting   the   user  is  that  it  doesn't  release
unnecessarily  reserved  RAM,  it  deletes his comments, it make the files
grow taking away free space from the HD/Disk and it makes some ASCII-chars
appear different (not changing the actual font-file as far as I know).




David A. Filskov
Kornerups Vænge 6, 2.th
4000 Roskilde
Tlf.: 4632-2799