- AramDol-Virus      File  Link

         cf. xcom-LVirus, HappyNewY.96
         Minimum version KS2.04: Queries on  Aram-Dol <(..
                  ;....
            646f732e 6c696272 61727900 000003ef dos.library.....
                                           ^^^^
         Changed vectors: LoadSeg LastAlert
         Survives reset: No
         File lengthened by: 560 Bytes
         Link after the first hunk.
         VT tries to reset LoadSeg.
         VT attempts to remove the link-virus from the file.
         Method of staying in memory:
           - LastAlert (FFFFF3EC) may not have been changed
           - LoadSeg changed
         Conditions:
           - File is not yet contaminated (Test 3EF)
           - Filename contains neither ".l" nor "-"
           - max. filelength ~80000 Bytes
           - min. filelength ~3000 Bytes
           - 3E9 hunk is found (Loop)
           - Disk validated
           - At least 4 blocks free
           - RTS is found ( max. loop $3F )
           - RTS replaced by bra.s or NOP (if RTS is at the end of the
             original first hunk)
         Skips over 3E8,3F0,3F1 hunks etc. !!!!!
         The part doesn't report itself.
         Hinweis:
         If your hard drive is very contaminated, then please begin with
         C-Verz. (File-Memory-File). By doing this, the ????


  --------------------------------------------------------------
   Translated to English by Antonio Remedios  2001 VHT-Denmark
   Org. Test by Heiner Schneegold.
  --------------------------------------------------------------

[Go back]