VIRUS HELP TEAM Amiga Antivirus Website www.vht-dk.dk
------------------------
Amiga Virus Encyclopedia
Fileghost 2 Virus
------------------------
Name : FileGhost 2
Aliases : No Aliases
Type : Link
Size : 796 bytes
Clones : No Clones
Symptoms : No Symptoms
Discovered : 13-11-94
Way to infect: Link Infection
Rating : Less Dangerous
Kickstarts : 2.X/3.X
Damage : Links itself to executable files.
Information : Please note, that this virus will be not installed by the
recognized Installer II !!!!
This is a linkvirus, which adds NO hunk to the infected file.
It will increase the first hunk (796 bytes) and changes the
"RTS" at the end of the hunk or tries to go back several
steps and searchs for a "RTS". This "RTS" will be replaced
by a "BRA XYZ". -> A virustype like Infiltrator, DA and
others.
The $3e8 hunks will be overjumped. Caution ! Read the DHunk
documentation !
The virus changes DOSLoadseg. No resetvectors will be changed.
Comments : The FileGhost 2 virus is a very simple and small one.
If you`re starting an infected file the virus patches
the LoadSeg()-Vector from the dos.library. This vector
is used to infect other files.
Files will be only infected if there isn`t a "." or a
"-" in the filename of the actuall file and only if
the drive isn`t write-protected and if there are at
last 8 blocks free. Files, which are greater than
100000 byte won`t be infected, too.
The virus is crypted by using $dff006. In memory you
can read:
"FileGhost 2 - Merry X-Mas and a happy new year..."
Antivirus : Kickstart 1.2 & 1.3..... : VT-Schutz
Kickstart 2.0 and higher : VirusZ III, with the new Xvs.library installed
Test made by : Markus Schmall and Safe Hex International
