----------------------------
    Amiga Virus Encyclopedia
    Fileghost Virus I & II Virus
    ----------------------------

        
    Fileghost Virus I:
    ------------------
    Works with Kickstart 3.1 and MC68040 !

    Is able to overjump symbol and debughunks at the beginning of
    the file.

    This is a linkvirus, which adds NO hunk to the infected file.
    It will increase the  first hunk (876 bytes)  and changes the
    "RTS" at  the  end of the hunk or  tries to go  back  several
    steps and searchs for a "RTS".  This "RTS" will  be  replaced
    by  a "BRA XYZ". -> A  virustype  like  Infiltrator,  DA  and
    others.

    The virus changed DOS(NEW)Loadseg and Exec Forbid. No  reset-
    vectors will be changed.

    At the end of the file you can read:
    (this text ist mostly decrypted by a "eor.b d0,(0)+" routine.
    Nothing special...

    'dos.library'
    'Hi Friend! Don`t worry... It`s only the '
    'FileGhost.'


    Fileghost Virus II:
    -------------------
    Works with Kickstart 3.1 and MC68040


    Please note, that this virus will be not installed by the
    recognized Installer II !!!!

    This is a linkvirus, which adds NO hunk to the infected file.
    It will increase the  first hunk (796 bytes)  and changes the
    "RTS" at  the  end of the hunk or  tries to go  back  several
    steps and searchs for a "RTS".  This "RTS" will  be  replaced
    by  a "BRA XYZ". -> A  virustype  like  Infiltrator,  DA  and
    others.

    The $3e8 hunks will be overjumped. Caution ! Read the DHunk
    documentation !

    The virus changes DOSLoadseg. No resetvectors will be changed.

    Selfrecognitioncode in memory: Test for the single longword:
                            $ABCD1234

    At the end of the file you can read:
    (this text ist mostly decrypted by a "add.b d0,(0)+" routine.
    Nothing special...


    FileGhost 2 - Merry X-Mas and a happy new year...


                  Detection for the Fileghost2 tested 26.09.1994.


    Comment 11.10.1994: As far as I know this virus is very wide
    spreaded in Germany. Many PD disks are infected and even a CD
    was infected and NOT released.

    I have just found a bug in my memorycheck routine, which I have
    now fixed. Sorry guys...

    Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
             Kickstart all others: VirusZ III, and also Xvs.library must be installed


    Test by Markus Schmall....