| Alias: | Exorcist Virus |
| Strain: | AlienNewBeat strain |
| detected when: | |
| where: | |
| Classification: | system virus (bootblock), resident |
| Length: | 1. Length on storage medium: 1024 bytes 2. Length in RAM: 1040 bytes |
Preconditions | |
| Operating System(s): | AMIGA-OS |
| Version/Release: | only AMIGA-OS 1.2 / all releases |
| Computer model(s): | all models |
| Caroname: | AlienNewBeat.Exorcist |
Attributes | |
| Easy identification: | text visible in bootblock: "Dark is the night, and so is your mind!" "You are now possessed by the SATAN virus!" "Dial 22304940, and ask for the EXORCIST!" ""Dominique et spiritus et sanctus"" "Long live the anti-christ, and please don't" "forget to turn the lights OFF!" "Regards from The Exorcist and SATAN!" |
Type of Infection: | |
| Infection Technique: | |
| Infection Trigger: | read or write access to an OS device with length 512 or 1024 (e.g. disk insertion) |
| Storage Media affected: | |
| Interrupts hooked: | |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | Permanent damage: overwritng boot block Transient damage: cancels sprite and audio DMA |
| Damage Trigger: | Permanent damage: see infection trigger Transient damage: 65535th DoIO call after last FindResident call |
| Particularities: | - resident programs using the CoolCapture or ColdCapture vectors are shut down - virus does not check if it actually writes to floppy disk, so hard disks can also be infected (or corrupted if bootblock is not block 0) |
| Similarities: | --- |
Agents | |
| Countermeasures: | Virus Workshop V3.6, VirusChecker V6.41, VT 2.65, VirusZ II-1.07 |
| Standard means: | VT 2.65 |
Acknowledgements | |
| Location: | Virus Test Center, University of Hamburg, Germany |
| Classification by: | Karim Senoucci |
| Documentation by: | Karim Senoucci |
| Date: | 12-July-1994 |
| Information Source: | Virus analysis, information by H.Schneegold |
(c) 1996 Virus-Test-Center, University of Hamburg