home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
telefisk.org
/
amiga_virus_collection_research.7z
/
VIRUSRESEARCH
/
DATATYPE_TROJAN
/
ANALYSIS.TXT
< prev
next >
Wrap
Text File
|
1999-06-12
|
1KB
|
39 lines
DatatType.library
=================
Size difference:
Version 45.4 = 27.780
Version 45.4/5 = 32.748
Version 45.4/5 = 4.968 bytes bigger then 45.4/5
On my machine I found the 45.4 version which was 32.748.
It dates from februari 998 so this suggests that a lot
of people have been victimised.
There is also a 45.5 version, this betrayes itself since
there has not yet been such a new version.
Can only be used on 3.0+ machines (because of version check)
Part of the code is encoded with simple encryption
rtick is to find the encoded part and the encoding
key to decode the stuff.
It is not infected with some kind of link virus since
a lot of changes inside could not have been done by a
virus but have to be changed manually. There is too much
changed too deeply.
Trojan part seems to be added at end of first hunk.
Bra to trojan part placed over "SUBA #$0014,A7"
This might cause severe crashes since it should
put the stack pointer back. This might be done in
the trojan code but I haven`t found this yet.
Deleting this file is adviced since a lot of stuff
has been changed and a few things have been added.
Some things have been manually added which would take
a lot of time and effort to put back, easiest thing is
to get the official library back and place it over the
trojan one.