VIRUS HELP TEAM



     ------------------------
     Amiga Virus Encyclopedia
     Wech Link Virus
     ------------------------
     

     Virus Help Team are looking for this virus, please send it to us
     
     
     - WECH-LVirus file link and destruction
     
             File extension: 952 bytes
             Bent vector: LoadSeg   
             LastAlert is also changed
             Resetfest: No.
             Link behind the first hunk.
             VT tries to reset Loadseg in memory.
             VT tries to remove the link part from a file.

       Memory anchoring:
             - LastAlert changed to 00FFFFFF, 01FFFFFF, 02FFFFFF etc.
             - LoadSeg is bent

       Destruction (on purpose):
             Once LastAlert and $ DFF006 have a certain value
             the beginning of the file overwritten.
             picture.datatype-destroyed:
              00: 57454348 57454348 57454348 57454348 CHANGEOVER
              10: 57454348 57454348 57454348 57454348 CHANGEOVER
              20: 57454348 57454348 57454348 00040000 EXCHANGE ...
             These files cannot be saved.
         
       Propagation conditions:
             - File is not yet contaminated (test with SetComment)
             - Filename does not contain "-", ". L"
             - File executable (3F3)
             - 3E9 hunk is found
             - Installation variants of the jump in the link part:
               - RTS at the hunk end should become NOP (NEVER successful in the test)
               - RTS 0000 at the Hunkend becomes NOPNOP
               - RTS not exactly at the hunk end becomes Bra.s
               - 4EAEwxyz in hunk becomes 4EBA virus
                 The part does not respond.

       Hints:
             - A syquest was unusable after 15 minutes.
             - Files were created WITHOUT jump jumps
               fail.
             - Files with defective files were created during the intended link process
               Link part.
             - No test on KS1.3 (LoadSeg)
             - Uses odd addresses
             - Probably confuses $ 80 (FIBlock) with $ 7c (FIBlock)
               Total guess: Beginners ?????


     Original test by Heiner Schneegold
     Translated from german to english by Google translate
     
     
     Virus Help Team are looking for this virus, please send it to us


     

Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht.dk