-----BEGIN PGP SIGNED MESSAGE----- ......................... VIRUS HELP DENMARK ...................... -------------------- 18 August 2001 Hi All.... Here we go again....... Yet, again another installer of the new virus 'Hitch-Hiker 5.00'. Again there is "NO" cure for this virus right now. You can find infected files, you will have to replace the infected files with new clean files. This installer will install the 'Hitch-Hiker v5.00' virus will add 3748 bytes to every infected file, and place it self in memory, so you will have to watch out for that as well. This virus will infect anything that it can get into. There is a way to see if the archive you download is an installer of this virus, all you have to do is to unpack the archive, read the file in an texteditor (eg. CygnusEd), and search for this text string in the code (THIS IS ONLY FOR THE INSTALLER): - -=COVAH=- If you find -=COVAH=- in the code, that is an installer of this virus then please send he archive to us. The virus size has change this time, now it is 3748 bytes. In the code (decoded), you can read: Hitch-Hiker Millenium (5.00) Featuring the Hitcher's Advanced Versatile Optimizing Codemix Engine A welcome present for Jan Erik by xxxxxx/xxx! - -= On Tour 1995-2001 =- (VHT-Denmark removed the names of the programmer handel, and replaced it with 'xxxxxx') If this is a welcome present for Jan Erik Olausen, the programmer of VirusExecutor & xvs.library, I think that he would rather have a cold beer. But he will surely put recog. for Hitch-Hiker 5.00 in the new update of xvs.library... The archive was uploaded to AmiNet, but it has been removed now. (Thanks Urban). This is what we know of the virus: Virus Type.... : Linkvirus Virus name.... : Hitch-Hiker 5.00 (Millenium) Virus size.... : 3748 bytes Archive name.. : S-Exec12.lha Archive size.. : 9.905 bytes (lha packed) Installer name : LibBase3.10 Installer size : S-Exec Archive info.. : Compress executables. There might just be more installers of the 'Hitch-Hiker 5.00' virus out there, we have found 3 archive in 2 days. If you find anything please send it to us. The 'xvs.library' (external Virus Scanner library) will be updated as soon as possible. In the mean time, take care... Thanks to D. Olsen for the info about the archive and to Ronald Dijk for sending the archive to us. Regards.... __ Jan Andersen E-Mail..: vht-dk@post4.tele.dk __ /// ------------ FidoNet.: 2:237/38.100 \\\/// Virus Help Denmark AmyNet..: 39:140/127.100 \XX/ www.vht-dk.dk VirNet..: 9:451/247.0 ... Did you know, that the newest version of xvs.library is v33.29 !! - ------------------------------------------------------- Archive has been checked and a .sig file has been added so you can verify there was no tampering with the file after placed on the server. MD5SUMS and Readme PGP signed by: Charlene e-mail: ml-clm@mailandnews.com md5sum: ftp.vapor.com/pub/3rdparty/ [Start md5sum checksum file]----------------------- e2f96d984665d0a9bdca4cc4c9e6ea90 *file_id.diz 954b975d562e0868a329059c79bd1374 *vht-dk_108.txt [End md5sum checksum file]----------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv Comment: Signed by Charlene, using PGPAmiga iQCVAwUBO38s3vrh//oWbqdVAQGjigP/R+x4Q9Nrtg+6V+EMAAlUQT37LoVLL2qD hKImj1NX4yU4BJZR/VZ4MkPp5QBJjtrZNqlPU7eit5M/Ji+ZeiH7Xix7zZHEJHjw YAGWC87R2MnJywh6wzQurON2XMeVU5Zt7W2CGYKx2Owq61LjIe4F/bklBZV6goAP 38U1w4YYQtM= =IWeL -----END PGP SIGNATURE-----