VIRUS HELP TEAM Amiga Antivirus Website www.vht-dk.dk
---------------------------
Amiga Virus Encyclopedia
MessAngel Killer
---------------------------
Name : MessAngel Killer
Aliases : Eleni 3 Dropper
Type/Size : Trojan
Size packed : 1808 bytes (Powerpacked)
Size unpacked: 7100 bytes
Clones : No Clones
Symptoms : No Symptoms
Discovered : 20-09-94
Way to infect: No Infection
Rating : Less Dangerous
Kickstarts : 2.X/3.X
Damage : Installs the ELENI 3 virus
Manifestation: Pretends to be a Viruskiller!
Removal : Delete File immediately.
Comments : If you`re starting the MessAngel trojan it gives out
the following text:
"MessAngel Killer by Docker of Twist!" ... etc.
After that it openes the startup-sequence and inserts
at the beginning "B + [Return]".
Then the virus writes the manipulated startup-seq.
ALWAYS with 5000 bytes no matter if the startup-seq.
was longer or shorter.
After that a file will be written called "sys:B".
This file is 1504 byte long and is the "real" virus-
installer. The file contains the whole ELENI3-Boot-
block which will be activated on the next boot up!
Info : This file pretends to be a viruskiller for the MessAngel
virus. If you start the programm, the Startup-Sequence
will be loaded and a new command will be placed in it.
Due to extremly lame programming, there will be always
saved 5000 bytes from the Startup-Sequence, even if it
was only 1000 bytes long before. Then the file "sys:b"
will be saved to disc and the following message will be
shown on the screen:
'MessAngel killer by Docker of Twist!'
'Checking startup-sequence...'
'VIRUS FOUND AND REMOVED!!!'
'Right to disable from memory!'
his text is a pure fake. For more information about the
ELENI! virus, please read the description here !!!!
Antivirus : Kickstart 1.2 & 1.3..... : VT-Schutz
Kickstart 2.0 and higher : VirusZ III, with the new Xvs.library installed
Test made by : Markus Schmall & Safe Hex International
Screenshot of MessAngel Killer (Eleni 3) Installer Virus:
