NewAge Linkvirus:

        Works not with Kickstart 1.x. An infected files becomes 668
        bytes  longer. This virus will  only change the  DosWrite()
        vector and is not resident.

        After some hours of trying to infect some testfiles, 2 files
        were infected. Thanks Ingo for this really exhausting work !

        The virus put his code in the first hunk & changes  the $3ec
        hunk. Due to some buggy routines in this virus, the infected
        files become not executable and VirusWorkshop cannot  remove
        this virus.

        At  the end of the virus, you can read
                          "NewAge by Evil Jesus".

        Due to thousand of bugs in the routines, I decided to write
        no repairroutine. My routine worked  fine for 1  hunkfiles,
        but if the file had more hunks, the routine crashed.

        Comment 15.05.1994: Sorry Ingo, my first success was on the
        DHB file. The infected cmon could not be recoverd.

        The german  viruskillerprogrammers  recieved  this virus  as
        sourcecode(written with Asm-One?) together with the Debugger
        virus. As far  as  I understood the whole thing, the  virus-
        programmer released an LHA file  containing source  and  the
        infected file for Debugger94 and this LHA file was send from
        a carefull user to Jan Bo Andersen, who send  this LHA  file
        to me.

                        > Only deletion is possible ! <

        Test by Markus Schmall          Detection tested 14.05.1994.

[Go back]