------------------------
Amiga Virus Encyclopedia
Hitch-Hiker v4.11 Virus
------------------------


-----------------------------------------------------------------------
          
Entry...............: HitchHiker 4.11
Alias(es)...........: CopyCat Decruncher 1.01
Virus Strain........: -
Virus detected when.: Febuary 1997
              where.: Germany and Italy
Classification......: Linkvirus,memory-resident, not reset-resident
Length of Virus.....: 1. Length on storage medium:     ca. 3052 Bytes
                      2. Length in RAM:                    3500 Bytes

--------------------- Preconditions ------------------------------------

Operating System(s).: AMIGA-DOS Version/Release.....: 2.04+ (V37-V40)
Computer model(s)...: all models/processors (MC68000-MC68060)
                      The virus heavy problems with the 060 cache

--------------------- Attributes ---------------------------------------

Easy Identification.: -

Type of infection...: Self-identification method in files:

                      - length of hunk 1

                      Self-identification method in memory:

                      - test for the changed jump command from
                        Exec PutMsg() and a longword in the trapcode.

                      System infection:

                      - The entryjump of Exec PutMsg() will be patched
                        to a trap code.
                      - A new trapcode will be installed.
                      - a process with a library name will be started,
                        which installs the patches again

                      Infection preconditions:

                       - HUNK_HEADER is found
                       - device is validated
                       - to be infected file is bigger than $be8
                       - 10 free diskblocks

Infection Trigger...: The infection is based on the packet handling
                      system of AMIGA OS. Every started file will be
                      infected. All synchron dos commands are affected.

Storage media affected:
                      all DOS-devices

Interrupts hooked...: A trapvector in the vectorbase will be changed

Damage..............: Permanent damage:
                      - none

                      Transient damage:
                      - The stealth/fileinfect engine performs a wrap
                        around copy of the originalfile as we saw it
                        already in the BEOL3 virus, which source was
                        made public by the programmer.


Damage Trigger......: Permanent damage:
                      - none
                      Transient damage:
                      - infecting a file

Particularities.....: The crypt/decrypt routines are not 100% aware of processor
                      caches. The packet handling works in even on the new developer
                      OS versions, but some codes have problems with task functions.

                      The virus is incompatible to the new versions of EXEC,
                      as it uses some commands only legal in V37-V41 versions
                      of the task handling.

                      The virus tunnels doscall watcher like SnoopDos etc. by
                      using only lowlevel packet routines.
                      
Similarities........: The link method has been seen in the BEOL3 linkvirus
                      already. A new hunkheader will be added and the origfile
                      will be seen as datahunk. In this way the virus doesnt
                      need to perform a errorfull hinkcorrection. The first
                      codehunk contains the virus itself.

Stealth.............: Second working directory and file stealth code in a virus.

Armouring...........: The virus is not armoured with a special tricky crypting
                      code. By adding the strings "CopyCat Decruncher 1.01"
                      and "FLK!" and "-TRSi-" the virusprogrammer wanted
                      probably hide his actions as the first 20 bytes of the
                      hunk could really look like an unpacker.

                      Some parts of the code will be manipulated online (data
                      reuse) and some functions refuses to work properly in
                      a testsuite.

Specialities........: As always the virus contains a crypted part:

                      'The Bastard is Back!',$0A
                      'The Hitch-Hiker',$0A
                      '- Version 4.11 ',$0A
                      'Greetings going like a scrolltext in the sky to:'
                      'Georg, Heiner, Markus, Johann, Pius, Zib, Ariel,'
                      'InFekt, UFO and all the guys on #amielit'
                      'Not yet deactivated by Flake!'

                      The last string depends probably on my removal code
                      for the hitchhiker 3 linkvirus, which overwrote parts
                      of the virus with a special other string.

--------------------- Agents -------------------------------------------

Countermeasures.....: VT 2.95, VW 6.5
above Standard means......: -

--------------------- Acknowledgement ----------------------------------

Location............: Hannover, Germany 01.03.1997.
Classification by...: Markus Schmall
Documentation by....: Markus Schmall (C)
Date................: Mar, 01. 1997
Information Source..: Reverse engineering of original virus
Copyright...........: This document is copyrighted and may be not used
                      in any SHI publication

===================== End of HitchHiker 4.11 Virus =========================