Virus Warning - Virus Help Team

VIRUS HELP TEAM
Denmark & Canada



Devilcheck 1.8 Fake Trojan
  
.-------------------------------------------------------------------------.
| WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING |
`-------------------------------------------------------------------------'

DevilCheck is one of the safest, most used programs, but some people just
can't stand it that other people have more and better ideas then themselves
so, thats why they fuck up other peoples products and try to fuck their
reputation.

This warning is about the 'new' released DevilCheck by some dorks called
Doodles^Shock. I must say that I was surprised to see that some UNAUTHORISED
person released MY product while it has been released by TRIBE.

Funki and I checked the archive after he had discovered it, and what do you
think? Yep, a BOMB! Well, the normal standard checker (offline) was not
touched (clever... not) but, the DD and X version (x_devilcheck and
dd_devilcheck) had been fucked up. After looking inside I knew it was a bomb,
and afer running it on a secure system, it showed, it was a bomb.

The file id of the dangerous archive is this one below:

  _____/\_:__/\___  __/\_______
o-\       :       \ \         /------------o
|  \___  _______   \_\  l____/             |
|    /   Y /   |    \ \__  \ Doodles^Shock |
|  _/    |/    '    /   l   \              |
|  \_____|\_______ /_______NeB  Presents   |
`--------:-------\/-------\/---------------'

               Devilcheck 1.8

            Virusworkshop option

The archive contains everything the tribe archive also contains, BUT the
dangerous part is the doors part. Both the /X and DD door versions are the
same length and that is NOT correct:

dd_devilcheck           32376
x_devilcheck            32376

In the files you will see that a weird message like:

Gotcha II (the window title when you start it)
Why did you run me ?!
Now I've gotcha again

It seems it fucks up the makedir, loadwb, setpatch, stack, type, hype
and hack.
After this 'hack' it resets, for whatever reason, I have not further checked
this because of safety rules on my HD, but I can tell you you should NOT
use THIS DevilCheck, it is a FAKE! Use the TRIBE archive instead!

Oh, how I would like to know, I am aching I must say, who these fuckers are
but, just remember that the ONLY OFFICIAL archive with the 100% DevilCheck
is the archive released by TRIBE!

Name of the CORRECT! TRIBE archive:

TRB-DV18.LHA

Contents of the CORRECT! archive:

file_id.diz       440 bytes
DEVILCHECK.lha  67188 bytes

Contents of the CORRECT! TRIBE DEVILCHECK.LHA:

BBS/COMMANDS/SYSCMD.info                1740
BBS/COMMANDS/SYSCMD/EXAMINE1.info       1061
BBS/DOORS/DevilCheck/dd_devilcheck     43976
BBS/DOORS/DevilCheck/DevilCheck.cfg      513
BBS/DOORS/DevilCheck/x_devilcheck      43972
BBS/DOORS/DevilCheck.info               1740
BBS/DOORS.info                          1740
BBS/COMMANDS.info                       1740
BBS.info                                1740
devilcheck                             43944
DevilCheck.cfg                           518
DevilCheck.DOC                         23935
DevilCheck.GUIDE                       27539
Updating.NFO                            1704

(take a look at the lengths of the dd and /x versions.)
.-------------------------------------------------------------------------.
| WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING |
`-------------------------------------------------------------------------'
-----------------------------------------------------------------------------



    Greets
               Markus Schmall




Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht-dk.dk