Entry...............: HitchHiker 4.23 Alias(es)...........: HitchHiker 4 Virus Strain........: - Virus detected when.: September 1997 where.: Germany, Denmark and England Classification......: Linkvirus,memory-resident, not reset-resident Length of Virus.....: 1. Length on storage medium: ca. 2912 Bytes 2. Length in RAM: 3200 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: AMIGA-DOS Version/Release.....: 2.04+ (V37-V40) Computer model(s)...: all models/processors (MC68000-MC68060) The virus has problems with higher processors and OS versions --------------------- Attributes --------------------------------------- Easy Identification.: - Type of infection...: - linkvirus. It changes the whole files to 2 hunked file and copies 2908 bytes from the filestart to the end Self-identification method in files: - checks for $DEAD at a special fileposition. In this way the stealth mechanism is locating the infected files, too. Self-identification method in memory: - test for the changed jump command from Exec PutMsg() System infection: - The entryjump of Exec PutMsg() will be patched to a trap code. - A new trapcode will be installed. - tries to modifies entry points of the bsdsocket.library, which is used by connectiontools like AmiTCP and Miami. Infection preconditions: - HUNK_HEADER is found - device is validated - to be infected file is bigger than 2908 (exact viruslength) - 10 free diskblocks Infection Trigger...: The infection is based on the packet handling system of AMIGA OS. Every started file will be infected. All synchron dos commands are affected. Storage media affected: all DOS-devices Interrupts hooked...: A trapvector in the vectorbase will be changed Damage..............: Permanent damage: - none Transient damage: - The stealth/fileinfect engine performs a wrap around copy of the originalfile as we saw it already in the BEOL3 virus, which source was made public by the programmer. Damage Trigger......: Permanent damage: - none Transient damage: - infecting a file Particularities.....: The crypt/decrypt routines are not 100% aware of processor caches. The packet handling works in even on the new developer OS versions, but some codes have problems with task functions. The virus tunnels doscall watcher like SnoopDos etc. by using only lowlevel packet routines. Similarities........: The link method has been seen in the BEOL3 linkvirus already. A new hunkheader will be added and the origfile will be seen as datahunk. In this way the virus doesnt need to perform a errorfull hinkcorrection. The first codehunk contains the virus itself. Stealth.............: Second working directory and file stealth code in a virus. Armouring...........: The virus is not armoured with a special tricky crypting code. Specialities........: As always the virus contains a crypted part: "LHALZXZOOZIP" "bsdsocket.library" "POST" "DATA" "QUIT" "The Hitch-Hiker 4.23 - Generation #00001036" The first string is for the special ability to keep the files infected, even if they get crunched. This trick, which was used to remove common pc stealth linkviruses is not working here. --------------------- Agents ------------------------------------------- Countermeasures.....: VT 3.00, AntiBeol 1.33, FastKill and VW 6.7 above Standard means......: - --------------------- Acknowledgement ---------------------------------- Location............: Hannover, Germany 26.09.1997. Classification by...: Markus Schmall Documentation by....: Markus Schmall (C) Date................: Sep, 29. 1997 Information Source..: Reverse engineering of original virus Copyright...........: This document is copyrighted and may be not used in any SHI publication ===================== End of HitchHiker 4.23 Virus ========================= [Go back]