CompuPhagozyte 5 Virus - Amiga Virus Encyclopedia

VIRUS HELP TEAM



     ------------------------
     Amiga Virus Encyclopedia    
     CompuPhagozyte 5 Virus
     ------------------------


     - CompuPhagozyte 5  File   known Filelengths: 892 Bytes
                                                   900 Bytes
                                                   936 Bytes (1.Hunk $CF)
                                                   936 Bytes (1.Hunk $CD)

          The different filelengths must be handmade while you do not find
          a code in the program that'll explain differences in length.

          Cool always $7C600, OldOpenLib always $7E000
          Reaerves areas in memory with AllocAbs:
               $7C000   the whole VirusPrg
               $7C600   CoolRoutine for RESET
               $7E000   OldOpenLibRoutine for spreading

               :A0A0A0A0  (invisible in root)
               :s/startup-sequence
          Now able to spread to other drives as well as DF0.
          Now you're able to read COMPUPhagozyte at the start:
                             434f4d50 55506861         COMPUPha
           676f7a79 74650a00                   gozyte..
          New: NO test for OldOpenLib = $FC1430 = KS1.2 anymore.
          KS2.04:After a keyboard reset it will reset in some time.

          Spreading:
          If another program calls OldOpenLib an infection of the program
          will be tried. It does not test for wwriteprotection. Memory at
          $7C000  should  be  written  as A0A0A0A0-File on the disk.  After
          that the startup-sequence will be changed.
          Advice: delete immedeately and test the startup-sequence too.

          Typ 5:
          00000000 00000000 00000000 00003aa0 ..............:.
          a0a0a000 3a732f73 74617274 75702d73 ....:s/startup-s
          65717565 6e636500 a0a0a0a0 0a200a54 equence...... .T
          6865206d 69676874 206f6620 54686520 he might of The
          456d7065 726f7220 69732075 6e6c696d Emperor is unlim
          69746564 20212121 0a200a00 000003ec ited !!!. ......

          Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                   Kickstart all others: VirusZ III with Xvs.library installed


     Translated text from VT-Knows by Heiner Schneegold
     Translated by Torben Danoe


     
     

Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht.dk