Menems Revenge Virus 1+2:
        -------------------------

        Typ 1:
        -Linkvirus
        -an infected file becomes 3076 bytes longer
        -two hunks will be added
         $3e9 hunk ($2b6)
         $3ea hunk ($23)

        Typ 1:
        -Linkvirus
        -an infected file becomes 3124 bytes longer
        -two hunks will be added
         $3e9 hunk ($2c2)
         $3ea hunk ($23)

         Only some bytes were changed from the first version to the
         next version. The first version appeared (I think) 1992 and
         the new version appeared 1994.

         The virus contains a checkroutine for files, which are longer
         than 60000 bytes. LoadSeg will be patched. No resetvectors
         will be touched. A new process with the name of a normal
         BLANK will be started.

         On some testconfigurations the files could not be repaired,
         because they contained pure garbage. Sorry.

         Sometimes a DisplayAlert routine shows you a text saying
         "Argentinia still lives..:". This text is crypted in the
         file with a asr command. No real destruction routine
         (except for the linking itself) was found in the virus.



         Test by Markus Schmall         Detection tested 19.03.1994.

[Go back]