------------------------
Amiga Virus Encyclopedia
AramDol Link Virus
------------------------
- AramDol-Virus File Link
cf. xcom-LVirus, HappyNewY.96
Minimum version KS2.04: Queries on Aram-Dol <(..
;....
646f732e 6c696272 61727900 000003ef dos.library.....
^^^^
Changed vectors: LoadSeg LastAlert
Survives reset: No
File lengthened by: 560 Bytes
Link after the first hunk.
VT tries to reset LoadSeg.
VT attempts to remove the link-virus from the file.
Method of staying in memory:
- LastAlert (FFFFF3EC) may not have been changed
- LoadSeg changed
Conditions:
- File is not yet contaminated (Test 3EF)
- Filename contains neither ".l" nor "-"
- max. filelength ~80000 Bytes
- min. filelength ~3000 Bytes
- 3E9 hunk is found (Loop)
- Disk validated
- At least 4 blocks free
- RTS is found ( max. loop $3F )
- RTS replaced by bra.s or NOP (if RTS is at the end of the
original first hunk)
Skips over 3E8,3F0,3F1 hunks etc. !!!!!
The part doesn't report itself.
Hinweis:
If your hard drive is very contaminated, then please begin with
C-Verz. (File-Memory-File). By doing this, the ????
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III with Xvs.library installed
--------------------------------------------------------------
Translated to English by Antonio Remedios © 2001 VHT-Denmark
Org. Test by Heiner Schneegold.
--------------------------------------------------------------