VIRUS HELP TEAM Amiga Antivirus Website www.vht-dk.dk
------------------------
Amiga Virus Encyclopedia
Fileghost 1 Virus
------------------------
Name : FileGhost 1
Aliases : -
Clones : No clones
Type : Link
Size : 872 bytes
Symptoms : No symptoms
Discovered : 16-11-93
Way to Infect: Link infection
Rating : Less Dangerous (Many Infections !!)
Kickstarts : 2.0/3.0 with & without cachet !
Info : Is able to overjump symbol and debughunks at the beginning of
the file.
This is a linkvirus, which adds NO hunk to the infected file.
It will increase the first hunk (876 bytes) and changes the
"RTS" at the end of the hunk or tries to go back several
steps and searchs for a "RTS". This "RTS" will be replaced
by a "BRA XYZ". -> A virustype like Infiltrator, DA and
others.
The virus changed DOS(NEW)Loadseg and Exec Forbid. No reset-
vectors will be changed.
Comments : It uses the LoadSeg and the NewLoadSeg
to get the names of all executed programms.
Then it links itself behind the 1. Hunk by
searching a RTS. (Just as Crime)
The virus just infects files which are:
- executeable
- smaller than 100000 bytes
- don`t have a "-" or a "." in their names.
The virus doesn`t infect libraries and handlers
In the virus there is a coded message:
"Hi Friend! Don`t worry... it`s only the FileGhost"
The virus isn`t resident.
A trojan is spread around which installs this virus.
(HardSpeeder - please look there !!)
ATTENTION: HD-Users! Be careful with this virus.
^^^^^^^^^ It infects files VERY FAST !!!
And because of the short length, the virus
doesn`t conspicuous.
Test by : Markus Schmall & Safe Hex International
Antivirus : Kickstart 1.2 & 1.3..... : VT-Schutz
Kickstart 2.0 and higher : VirusZ III, with the new Xvs.library installed
