Amiga Virus Encyclopedia
Fileghost 3 Virus
Fileghost 3 Linkvirus:
MC68040 and MC68060: yes
Kickstart V35 and above
Patched vectors: DOS LoadSeg()
Increases filelength by 1288 bytes
Detected: Jun`95 in the south of Germany
This is another linkvirus out of the Fileghost series. This linkviruses
just add their code to the end of the first hunk and then search for the
last "rts" and modify it to a "bsr.b" to get activated. So the relochunks
will stay unchanged.
Differences to the previous versions of the virusfamily:
1. Some more indirect adressing
2. Test, if SnoopDos (FindTask "SnoopDos") is active
3. It will be searched for 2 longwords in the first hunk
$53460C46 at offset $2A from the loadseg() memptr
$2F49003C at offset $3A " " "
If you know, which programm has such longs in the first hunk, please
let me know. Thanks.
4. The cryptroutine is a little bit advanced.
5. The word $1994 will be used to check, if the virus already infected the
LoadSeg() vector. This routine is comparable to Fileghost2 and to
the Polygonifrikator viruses.
6. Depending on a spreading counter, the virus will set new windowtitles
(see at the bottom of the description).
The fileghost virus contains no destructive routine. As on every type of
this type of virus, it is possible that programms, which need a 100%
correct hunkstructure (e.g. some packers) will get problems and will
The virus is, in my opinion, not from the author of the last Fileghost
viruses. This one has display routines and will be recognized by the
infected user in this way very fast. The last versions of Fileghost just
worked around in the background.
New texts for the windowtitles:
'AUA! schlag nicht so auf die Tasten!'
'FileGhost3 - the nightmare continues!'
'Was machst Du denn als nachstes ?'
'Weist Du eigentlich, das Du dumm bist ?'
'Und schon wieder eine Datei weniger!'
'Gib mir mal n Bier!'
'Totet alle Nazis + RAPER!'
'AMIGA kills PC! (HEHE)'
'INTeL Outside !'
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III, and also Xvs.library must be installed
Greets Markus Schmall
(Please remember, that this analysis is copyrighted by Markus Schmall and it
is not allowed to include this analysis in SHI productions!)
Animated picture of the FileGhost 3 virus: