MessKill killer.doc

Credits:

Coded by Coolorado/Corpse

How the killer works:

First of all I must let you know that it was quite difficult for me to 
code this viruskiller because this virus was (hehehe!) a strange son of
a bitch! Ok I don't want you to get bored because of listening to my 
personal experiences but let me just tell you how the virus works:
The virus spread in a file called Messkill.lha which in the File id 
seemed to be a viruskiller with the ability remove the so 
called 'MessAngel' virus which within my knowledge doesn't exist at all!
However, when I tried to run the file MessAngelKiller.exe that was
included in the archieve messkill.lha the program told me that it was
checking my startup-sequence. Yeahhh! Great I thought, now it will
remove the virus that it pretended to have found! But eat my balls, 
instead it installed a file called B onto sys: and then also prepared 
it to be executed from the top of the startup-sequence. The program then
made a reset on my command (There was no other option) to remove the 
virus from memory with a reset. And so it did! My computer booted up 
normally until I watched it do another reset almost immediately when 
trying to procede with the startup-sequence. Strange! Well, it booted up
again but this time with no reset! Everything seemed to be alright until
when I later checked the contents of my hd. There it was, the file B.
Hmm, I checked it up and began to think about possibilities of a virus
infection. I checked my startup-sequence which now was much bigger than
before and found that the file B was called from it! So, what the fuck, I
deleted the file B and removed it from my startup-sequence and rebooted
my computer. Yeaaah, there came an error requester! Hmm, I rebooted 
holding down both buttons and made the computer boot without startup.
Now it worked. I checked the file that had flipped out but couldn't find
anything special execept that it had been saved today!! Now I was almost
sure that I was suffering from a virus, so I began to investigate other
files on my Hd and found that quite many files had been saved today!!
Now I will not tell you in detail how I managed to discover the function
of the infected files etc etc because then I could write a book!! But,
the main idea is that the file B was the mother of all other infected 
files. Then when you removed the B file the other files fucked up!
What the motherfile did was that it infected the files by searching for
a Jsr -$228(a6) instruction which is used to open a library. Almost every
file does this! Then it replaced it with it's own instruction which 
was Jsr -$1400(a6) and saved the file! Now, if the motherfile wasn't in
memory, then the latest mentioned instuction would not work because the
computer wouldn't find anything at -$1400(a6), but if the motherfile was
in memory then it would find the old Jmp -$228(a6) instruction at -$1400(a6)
and the computer would continue it's work! Smart but not enough!! 
What my repair program does is that it runs parts of the virus but wice versa!
If it finds a jsr -$1400(a6) instruction then it will replace it with its
original instruction (jsr -$228(a6)). Now, since I'm not a master in 
programming and time was running away (who want's the killer at Christmas
time?)
I released this version (0.9) so that you at least can repair your most
important programs. I give no guarantees that it will repair ALL you files
because as I said before, I can't make such a program because of a simple
but annoying guru in my first source code (never released!).
Ok, instruction for how to use the killer for best result:

Put this in your startup-sequence:
Run Repair.exe

Now you will see a window at the upper right side of you screen which 
indicates which files have been tested and (perhaps!) also repaired.
Observe that the killer doesn't check all files that are being executed.
When your startup-sequence has done all it's supposed to do, then run
as many of your programs as you can. Almost every file (libs/#? etc etc)
that is related to the program you run will be tested and repaired if 
infected. When you think that you have tested the most probably infected
files then you can remove the killer from your startup-sequence and try
to run your startup without it! If everything now works fine=no gurus then
the repair was successful. Otherwize the computer will (like before) flip
out on some files. But don't give up! Then follow step II:

Step II:

Boot your computer with no startup-sequence
Type 'run Repair.exe' at the promt
Now, if your startup-sequence for example fucked up when trying to load 
the file c/VirusChecker then (*THIS IS IMPORTANT*) enter the filename
INCLUDING all its paths. In this case I would type:
Dh0:C/Viruschecker
This is so that the killer finds the file!! Now you can be 99% sure that 
the file has been repaired (if infected), otherwize mail me a bomb!!!

I think that's all, but if you find any bugs or want some personal help
from me then you're welcome to visit me at any Corpse dist site!
Signed....Coolorado/Corpse

Personal greetings from me to:
Orgasmatron/X-trade - Dixy/Disorder - Pain/Indep - Mr.Coke (know me?)
Warhammer/Afl - Duffy/Spoon - All Corpse Members - All X-trade's
and everyone who deserves it!!!