------------------------
Amiga Virus Encyclopedia
Poland Virus
------------------------
- Poland-LVirus link virus
Reason for name: see destruction
File extension: # 840 bytes
Not reset-proof
Bent vector: DoIo LoadSeg
Error source: no test on KS1.3 (Loadseg)
Memory anchoring:
- Test whether it is already in memory
- Loadseg and DoIo are bent
- Tests later loaded file names for "v" or "V".
Link operation:
- with LoadSeg
- File not yet contaminated
- Medium validated
- 4 blocks free
- File length less # 157196
- File executable ($ 3F3)
- CodeHunk is found ($ 3E9)
- 1.Hunk not bigger than # 32764 (due to jump)
- The first LW of the 1st hunk is infected by bsr virus
replaced.
- Link behind the 1st hunk
- the part is always re-encoded with $ DFF00A
Destruction:
- with DoIo
- no test on trackdisk.device (also HD !!!)
- Block number is determined with $ DFF006, but must be larger
as # 63 ($ 7E00 / # 512). With two file systems in the rigid
area, could also destroy the part there.
- The block is written from $ 1f8 * Poland *. There is
nothing more to save.
Block: 1345
000: 00000008 00000510 00000031 000001e8 ........... 1 ....
; ......
1f0: e3dbe3db e3dbe3db 2a506f6c 616e642a ........ * Poland *
Original test by Heiner Schneegold
Translated from german to english by Google translate