------------------------
Amiga Virus Encyclopedia
Rastenbork Installer
------------------------
Rastenbork Installer:
Packed: 5220 bytes (PP 4.0)
unpacked: 8640 bytes
This is just a little lame installer for two bootblockviruses.
The work looks pretty lame and the texts in the installer sound
for me like a work of a little boy trying to get famous by
writing such shit.
To this little lame guy: If I get you, you have a serious problem.
To the polish organizers of TRSi: If I were you, kick this guy
very fast.
The installer just writes via TDdevice 2 viruses on the
bootblock and is even in this part buggy.
Visible text in this installer:
'need reqtools.library! Sucker!'
'Panic! I can',27,'t open trackdisk.device!'
'reqtools.library'
'intuition.library'
'trackdisk.device'
'ThE rASTenbOrk iNsTAller by PePe/tRSi'
'VirusInfo'
'About installer...'
'WhAt tHE hEll ?!'
'Oh no...the CoolCapture vector seems to '
'be changed!!!'
'If you have virus in memory,installing will'
' not work'
'resident virus will reinstall itself!!!'
'but it doesn',27,'t have to be a virus.'
'QUiT|prOCEEd'
'Back to menu'
'vIRUs->dF0|vIRUs iNFo|< ---|--->|aBoUt|QUit'
'vIRUs->dF0|vIRUs iNFo|--- >|aBoUt|QUiT'
'vIRUs->dF0|vIRUs iNFo|< ---|aBoUt|QUiT'
'----------------------------------------'
'-----------------------------'
'rASTenbOrk vIRUs liBraRy '
' Last update: 1994.11.29'
'----------------------------------------'
'-----------------------------'
'Virus name.......Rastenbork Virus'
'Version..........1.2'
'Born.............1994.04.28'
'Action...........writes rubbish to the '
'root block after 10 times disk'
' changed in any drive '
'since last soft reset'
'Help.............use any disk repairing '
'program (eg.FixDisk)'
'recognization....$f0f screen while bootin'
' included text ',27,'Boot Vir'
'us Protector v5.4',27
' and ',27,'A NPS production.',27
'Notes............one of first releases o'
'f Rastenborg and therefore'
' with some bugs (get Viru'
'sInfo).'
'----------------------------------------'
'-----------------------------'
'01 of 02 kEE'
'p oUT oF tHE rEaCh Of lAMerS !'
'----------------------------------------'
'-----------------------------'
'Information on Rastenbork Virus 1.2:'
'This is the first release of Rastenbork, '
'and contains some bugs, which'
'may be found as one of destructive ac'
'tions of virus, however they'
'haven',27,'t been planned. Here are some techn'
'ical informations:'
'auto memory alloc at every reset'
'new DoIO handler for all actions'
'installs on every unprotected disk at '
'disk changing'
'-after changing disk 10 times (any driv'
'e) since last reset exchanges'
'next read DoIO operation to write, so '
' usually the rootblock (880)'
$A
' is destroyed,then writes intuition aler'
't.'
'includes coded text'
'-includes not coded text suggesting tha'
't bootblock is a Vir Protector'
'And the most important bugs:'
'does not check if disk is in AmigaDOS, '
'so booting from HD with virus'
$A
' in memory equals babbling the HD 0 bl'
'ock (funny?). This hasn',27,'t been'
'planned but may be used against HD users'
'!'
'-does not check if disk has already b'
'een installed with the virus,'
'so the disk changing operation takes s'
'ome more time on every disk,'
' but this doesn',27,'t cause any troubles '
' for the virus bootblock data'
'isn',27,'t self-changing.'
'----------------------------------------'
'-----------------------------'
'rASTenbOrk vIRUs liBraRy '
' Last update: 1994.11.29'
'----------------------------------------'
'-----------------------------'
'Virus name.......Rastenbork Casher Virus'
'Version..........2.0'
'orn.............1994.11.28'
'ction...........codes directory blocks a'
'fter 10 boots from'
' infected disk'
'Help.............decoding possible'
'ecognization....$fff screen while bootin'
'g'
' included text ',27,'Panzer t'
'otal anti virus system',27
$A
'Notes............latest release so far,b'
'ut who knows what the future'
' will bring...'
'----------------------------------------'
'------------------------------'
'2 of 02 kEEp'
' oUT oF tHE rEaCh Of lAMerS !'
'----------------------------------------'
'------------------------------'
'Information on Rastenbork Casher Virus 2'
'.0:'
'his is the second release of Rastenbo'
'rk and is a little improved'
'comparing to the previously one. Has als'
'o other destruction idea.'
'Technical informations:'
'-auto memory alloc at every reset'
'-new DoIO handler for self-copying actio'
'n'
'-installs on every unprotected disk at d'
'isk changing'
'each boot from infected disk increases '
'internal counter and rewrites'
' bootblock'
'after ten boots from the same infected d'
'isk, the sectors of directory'
' block are being coded,so fix disk isn',27,'t'
' enough to restore data.'
'Anyway,this can be done.'
'includes coded text'
'-includes not coded text suggesting tha'
't bootblock is a Vir Protector'
'checks if disk has been previously insta'
'lled with this virus; if yes,'
' leaves it alone'
'checks if disk is in AmigaDOS,if it is n'
'ot,it should not proceed with'
' installing disk with virus.This ought t'
'o keep hard disks free from'
' destroying their 0&1 blocks,but I haven'
't tested this yet.'
'This little program allows you to insta'
'll two versions of Rastenbork'
'irus.The question remaining is what for?'
' I don',27,'t know.Coding viruses'
'ive much fun, so that is why I coded tho'
'se. And what is use of this'
'nstaller for you? Is there any sense? I'
' don',27,'t think so, but you can'
'end virus to any of your enemies and wat'
'ch him carefully.Treat it as'
' test of my work.'
'Please, spread this installer only to y'
'our friends and use it within'
'any lamer you know.'
'If my viruses have caused any troubles t'
'o any scene dudes,please take'
'my deepest apologies.They weren',27,'t meant '
'in this way.'
'If you want to contact the author, for'
' any reason or just for new'
'friendship (no swap), please write to:'
' PePe/tRSi,'
'400 Ketrzyn,POLAND'
'Greetings to anyone I have ever met on m'
'y way, and to those I haven',27,'t'
'had pleasure to know...'
'os.library'
'intuition.library'
'Boot Virus Protector v5.4'
'Vectors wrong!'
'Boot contains SCA (or similar) virus !'
'Cold'
'Cool'
'DoIO changed!'
'A NPS production.'
'DOS'
'dos.library'
'intuition.library'
'Panzer total anti virus system'
'Virus destroyed!'
Test by Markus Schmall Detection tested 26.02.1995
Screenshot of Rastenbork v1.2 Virus dropper:
Screenshot of Rastenbork v2.0 Virus dropper:
Screenshot of Rastenbork v2.0 Virus dropper:
