------------------------    
     Amiga Virus Encyclopedia    
     Neurotic Death 3 Inst.
     ------------------------

    
     Name         : Neurotic Death 3 Inst.

     Other name   : Mutagen 2E

     Aliases      : No Aliases

     Original     : -

     Type         : Trojan
     
     Size         : 4.112 bytes

     Symptoms     : No Sypmtoms

     Discovered   : June 1997

     Way to infect: Data  destruction:  Every 3 reads  from  the current drive, the virus
                    randomly selects  a number  and  overwrites a random sector with this
                    number on the disk with random data.
                    Hiding in memory: The virus detects the activity of popular antivirus
                    programs and does not infect if they are running. If an infected file
                    is run and the antivirus program is active, the virus installs itself
                    in memory and  waits  for it  to finish.  If the virus  was  launched
                    before  the  antivirus  program,  it  detects  the  fact that  it was
                    launched, removes  it's modifications  and  waits  for  the antivirus
                    program to  finish. In  addition, the  virus code is 95% encrypted in
                    memory.

     Rating       : Dangerous

     Kickstarts   : 1.3 infected programs hang
                    2.0
                    3.0

     Damage       : ND  is *BIG*, *HIGHLY*  polymorphic,  partly stealth  and destructive
                    virus coded  in Poland.  Virus  patches  LoadSeg() vector.  Length is
                    random; implemented [MutaGen2]_E polymorphic module.
                    ND (like 'Elbereth' viruses) kick out from memory ANY patch installed
                    on patched  vectors in  memory before virus  by  calculation value of
                    original adress  of LoadSeg  in ROM.  Additionally  DoIO() vector was
                    patched to annihilate Your HD.

     Visible text : =[Mtg_2C]=
                    ---=[ NEurOTiC DEatH 2 ]=---
                    (c) 1997 Poland
                    to *Markus*
                    m/\|) r0GEr
                    !! SECOND IN POLYMORPHIC SERIES !!
     
     Removal      : VirusZ III with Xvs.library installed

     Test made by : Jan Andersen - Virus Help Team