- Hitch-Hiker-2-Virus Link Archives known to be infected: DMS 2.40 update DeluxeGalage VersionNo. unknown Filesizeincrease: 1848-1908 bytes in dependance to $DFF007 Requieres KS 2.04 Hidden vectors: LoadSeg, Write Changed: LastAlert $BADCODED Not resetresistant This thing doesnt` show itselves Codeing in dependance to $DFF007 Decoded you can read in the linkpart: 54686520 48697463 682d4869 6b65720a The Hitch-Hiker. 47656e65 72617469 6f6e3a20 30303030 Generation: 0000 30313233 0a2d2056 65727369 6f6e2032 0123.- Version 2 2e30310a 0a0a5468 616e6b73 20666f72 .01...Thanks for 20746865 20526964 652c204d 69737465 the Ride, Miste 7221210a 00000000 r!!..... Installation in memmory: LastAlert (202(a6)) is checked for $ABBAFAB4 and $BADCODED. If yes -> end. LoadSeg and Write will be hidden, in LastAlert BADCODED is written. Link in file after first Hunk: Disk validated and min. #10 blocks free File executeable (3F3) Codehunk is found (3E9) Filename is NOT tested for certain characters In the viruscode a maxsize border is found, but this border was surpassed MANYTIMES on a 68040 during a test reproduction. move.l 4,a6 (6bytes), move.l 4.w,a6 (4 bytes) or RTS is found in the first hunk. The difference from this point to the original end of the first hunk is not bigger then $7FFF (for move) or $7F (for RTS). If this conditions are fullfilled, a move.l 4 command is replaced by a BSR command ($6100uvwx). If the original command was 6 bytes long a NOP is added to fill up. The RTS command is replaced by a BRA.s command ($60uv). It is possible that MULTIBLE jumps are created. VT tries on remove, to set move.l and move.w in dependance to a found NOP. The BRA.s command should be replaced with a RTS by VT. (also multible) Multibel links to one file could NOT be created. Hint 1: While testing defect file were also created. VT should cancel the removeprocedure and offer only deletion. Hint 2: If your Harddisk is infected all over, please go to Sp->File->Sp, choose a subdirectory ( c for instance) then click DirFTest. After this coninue with further subdirectories. -------------------------------------------------------------- Translated to English by Frank Cieslewicz © 2001 VHT-Denmark Org. Test by Heiner Schneegold. -------------------------------------------------------------- [Go back]