ELENI! Installer + ELENI! SysB file:
        ------------------------------------


         ELENI! sysb file:
         -----------------

         This name is based on the location of this file: "sys:b"


            This file is 1504 bytes long and contains the bootblockvirus
            and a little DOS  startprogramm for it. Please read  in  the
            bootblockvirussection for more information about this virus.


         ELENI! Installer:
         -----------------

         Filelength: 1808 bytes (packed with TurboSqueezer 8.0)
                     7100 bytes unpacked


         This file pretends to be a viruskiller for the MessAngel
         virus. If you start the programm, the Startup-Sequence
         will be loaded and a new command will be placed in it.
         Due to extremly lame programming, there will be always
         saved 5000 bytes from the Startup-Sequence, even if it
         was only 1000 bytes long before. Then the file "sys:b"
         will be saved to disc and the following message will be
         shown on the screen:


                'MessAngel killer by Docker of Twist!'
                'Checking startup-sequence...'
                'VIRUS FOUND AND REMOVED!!!'
                'Right to disable from memory!'
                '----------------------------'


         This text is a pure fake. For more information about the
         ELENI! virus, please read the description in the bootblock-
         virussection !!!!



                                        Detection tested 30.09.1994.


        In the document there will be mentioned two telephonenumber,
        which you can call, if  you  have  problems  with  the  fake
        viruskiller. This  are , as far as I know, the numbers  from
        the swedish DATOR magazine. Another hint that this virus was
        created somewhere in Scandinavia....

        Comment 03.10.1994:
        -------------------

        It appeared a special MessKill Repair programm (v0.9), which
        installs a new LoadSeg patch. This patch will be removed by
        VirusWorkshop, too.

        Special thanks to MFM/Skid Row for the first warning concerning
        this virus !


        Test by Markus Schmall

[Go back]