Sepultura 2.26 Virus:
        ---------------------

        Works with MC68040 (without caches) and Kickstart 3.0

        It patches:
                   DosLoadseg()
                   DosRename()
                   DosDelete()
                   DosLock()
                   DosOpen()

        No resetvectors will be changed !

        The virus writes a not visible file to drive df0. It makes  the
        Startup-Sequence 5 bytes longer and inserts its own filename at
        the top of the Startup-Sequence.

        At the bottom you can read (after decoding it):

        'Wer schaut mich an in dieser Eil sind '
        'wir etwa nötig geil? Bitte, bitte laß mich'
        'da, sonst sag ichs meinem Großpapa.'
        ' (w) Sepultura (V2.26)'

        The adress $7fff0.l will be accessed without  allocating it  !
        The virus will be crypted with a value out of $dff006 (VBI).




        Test by Markus Schmall          Detection tested on 17.11.1993.
                                          Ramkill tested on 17.11.1993.

[Go back]