VIRUS HELP TEAM



    ------------------------
    Amiga Virus Encyclopedia
    NewAge Link Virus
    ------------------------


    NewAge Linkvirus:
    -----------------

    Works not with Kickstart 1.x. An infected files becomes 668
    bytes  longer. This virus will  only change the  DosWrite()
    vector and is not resident.

    After some hours of trying to infect some testfiles, 2 files
    were infected. Thanks Ingo for this really exhausting work !

    The virus put his code in the first hunk & changes  the $3ec
    hunk. Due to some buggy routines in this virus, the infected
    files become not executable and VirusWorkshop cannot  remove
    this virus.

    At  the end of the virus, you can read
                      "NewAge by Evil Jesus".

    Due to thousand of bugs in the routines, I decided to write
    no repairroutine. My routine worked  fine for 1  hunkfiles,
    but if the file had more hunks, the routine crashed.

    Comment 15.05.1994: Sorry Ingo, my first success was on the
    DHB file. The infected cmon could not be recoverd.

    The german  viruskillerprogrammers  recieved  this virus  as
    sourcecode(written with Asm-One?) together with the Debugger
    virus. As far  as  I understood the whole thing, the  virus-
    programmer released an LHA file  containing source  and  the
    infected file for Debugger94 and this LHA file was send from
    a carefull user to Jan Bo Andersen, who send  this LHA  file
    to me.


                                 > Only deletion is possible ! <


    Test by Markus Schmall          Detection tested 14.05.1994.


    

Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht.dk