- AramDol-Virus      File  Link

         cf. xcom-LVirus, HappyNewY.96
         Minimum version KS2.04: Queries on  Aram-Dol <(..
            646f732e 6c696272 61727900 000003ef dos.library.....
         Changed vectors: LoadSeg LastAlert
         Survives reset: No
         File lengthened by: 560 Bytes
         Link after the first hunk.
         VT tries to reset LoadSeg.
         VT attempts to remove the link-virus from the file.
         Method of staying in memory:
           - LastAlert (FFFFF3EC) may not have been changed
           - LoadSeg changed
           - File is not yet contaminated (Test 3EF)
           - Filename contains neither ".l" nor "-"
           - max. filelength ~80000 Bytes
           - min. filelength ~3000 Bytes
           - 3E9 hunk is found (Loop)
           - Disk validated
           - At least 4 blocks free
           - RTS is found ( max. loop $3F )
           - RTS replaced by bra.s or NOP (if RTS is at the end of the
             original first hunk)
         Skips over 3E8,3F0,3F1 hunks etc. !!!!!
         The part doesn't report itself.
         If your hard drive is very contaminated, then please begin with
         C-Verz. (File-Memory-File). By doing this, the ????

   Translated to English by Antonio Remedios  2001 VHT-Denmark
   Org. Test by Heiner Schneegold.

[Go back]