------------------------
Amiga Virus Encyclopedia
ConMan HD Faker
------------------------
- CONMAN-HD-FAKER Destruction-File
possible filename : keymaker
at the end of the file you can read :
USAGE:KEYMAKER -i -a < REGISTRATION-NAME > < DEST > usw.
Length : 1596 Bytes
NO bent vectors
NO spreading
VT only suggests erase, cause the keymaker-part doesn't
do anything.
Two parts were linked with 4EB9-method. The Virus-part
remains packed.
Unpacked you can read this :
11534353 492d4844 2d46414b 45522057 .SCSI-HD-FAKER W
52495454 454e2042 5920434f 4e4d414e RITTEN BY CONMAN
;...
72617279 00736373 692e6465 76696365 rary.scsi.device
0a006776 70736373 692e6465 76696365 ..gvpscsi.device
0a006d61 78786f6e 2e646576 6963650a ..maxxon.device.
0000616c 66736373 692e6465 76696365 ..alfscsi.device
0a00636f 6e6d616e 0a00300a 00000000 ..conman..0.....
Damage :
Searching for special devices (look above) and the Rigid-
Disk-Block (RDB) will be modified. Decoding is NOT
possible. But since you´ve made a backup of your RDB
with VT some time ago (you have, do you ???) just write
it back after re-initialize your HardDisk with the
HDToolBox. Maybe you can also do a hardcopy of VT-LWInfo
to have the correct Cylinder counting etc.
At the end of the Destruction-routine an alerttext
appears : "SCSI-HD-FAKER WRITTEN BY....."
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III, and also Xvs.library must be installed
------------------------------------------------------
Translated to English by M0rpheus © 2001 VHT-Denmark
Org. Test by Heiner Schneegold.
------------------------------------------------------
☣ |
Virum Help Team Denmark & Canada Copyright © All rights reserved www.vht.dk |
☣ |
| |