Name : Hardex Virus Aliases : A Saddam Hussein clone Type/Size : Disk-Validator virus/1848 Discovered : 10-09-93 Way to infect: L/Disk-validator, (if not found the virus makes one) Rating : Dangerous Kickstarts : 1.2/1.3 (all using Disk-Validator) Damage : Destroys block by overwriting Comments : The Hardex and Saddam Hussein virus is a modification of: Return of the Lamer Exterminator 1848 bytes in SYS:l/Named Disk-Validator The Hardex virus will try to make a senseless pointer to a false bitmap in the root-dir. The failing attempt to validate the disk will invoke the virus and it will then install itself at all, none writeprotected disks. In fact a Kick1.2/3 harddisk partition, too. If the Root:l/ not exists on a new formatted disk, it will then create it itself. Old versions of the system requires the disk-validator program to validate disks. The Saddam clones makes it impossible to validate disks. Therefore you will, every time you insert a disk, ( or boot your harddisk, copy to, delete from ) see the drive work for an exorbitant long time. For the harddisk it can take minutes, if it get finished at all. DAMAGE: After a counter has been decreased the virus will write the word "HARD" a number of times in the fileheaders. When it is the line with File - first block start at address: Number of blocks in sequence: Next block in sequence: Block checksum: you can regard that the file is destroyed. The AmigaDOS will report: Block checksum error and you will get a requester like: Not a DOS disk in drive: or Disk not validated Diskstructure currupt Use DiskDoctor to correct it The name below the disk.icon is NDOS Some mutations will cause the read/writeheads step over the disksurface and will possibly scratch it then. Some of the mutations will only write the word "HARD" one time in executable files when they are runned and then decode the rest of the block. In this way it is impossible to see the virus as long as it is in memory. That implicates that if your Disk-Validator on the harddisk is wrong, the virus will hide itself until the counter reach zero. An alert will then possibly display the text: HARDEX VIRUS. That specifik specimen has before that likely formatted your disk. (Partition with the system). In System 2.0 the disk will be unreadable because of calls to a non existing device. But as soon as the disk is used with the infected System 1.3 the files will be readable again. The fake Disk-Validator will then be active and it works like a decrypter of its own files. (Infected file headers). Possibly Disk utilities like FixDisk and QuarterBack TOOLS will repair the bad bitmap at the bad address and then damage some files. But most of the virus killers today is presumably able to reconstruct the files. If you will know the mechanisms in details, try to write to one of the Virus-Killer programmers and ask. Don't forget a bill in the letter. PLEASE REMARK ŻŻŻŻŻŻŻŻŻŻŻŻŻ If your viruskiller detects a virus from the Lamer, ZVirus or Boot Revenge family, don't stop the process before the intire device is tested. Some virusprogrammers modify the old bootviruses so they can copy a Disk-Validator from one disk to another. I.e. infected with an inactive virus. Of course it only works with system diskettes with all the system directories. But as pointed out earlier, at the first moment a BitMap turns false the virus will be activated and then copy itself. And,- if you Format or DiskCopy a disk it will then copy itself, too, because of a call to trackdisk.device. It will start the validating process at drive df0: e.g. If you have booted from the harddisk you will not see a nonvalid disk.icon then. REPAIR: Delete the Hardex virus on all bootable disks immediately and copy the Disk-Validator from the write-protected Wb-disk to them. Check all your disks with a good viruskiller. Or check if some of your none bootable disks should content a :l/Disk-Validator. Then delete. The virus killers are able to find and repair the bad files and drawers, but as an extra certainty you can use FixDisk or QuarterBack TOOLS after that. SHI - TBH 04-94 [Go back]