Poland Virus - Amiga Virus Encyclopedia

VIRUS HELP TEAM




     ------------------------
     Amiga Virus Encyclopedia
     Poland Virus
     ------------------------
     
     
    - Poland-LVirus link virus
          Reason for name: see destruction
          File extension: # 840 bytes
          Not reset-proof
          Bent vector: DoIo LoadSeg
          Error source: no test on KS1.3 (Loadseg)

      Memory anchoring:
           - Test whether it is already in memory
           - Loadseg and DoIo are bent
           - Tests later loaded file names for "v" or "V".

      Link operation:
           - with LoadSeg
           - File not yet contaminated
           - Medium validated
           - 4 blocks free
           - File length less # 157196
           - File executable ($ 3F3)
           - CodeHunk is found ($ 3E9)
           - 1.Hunk not bigger than # 32764 (due to jump)
           - The first LW of the 1st hunk is infected by bsr virus
             replaced.
           - Link behind the 1st hunk
           - the part is always re-encoded with $ DFF00A

      Destruction:
           - with DoIo
           - no test on trackdisk.device (also HD !!!)
           - Block number is determined with $ DFF006, but must be larger
             as # 63 ($ 7E00 / # 512). With two file systems in the rigid
             area, could also destroy the part there.
           - The block is written from $ 1f8 * Poland *. There is
             nothing more to save.
           Block: 1345
           000: 00000008 00000510 00000031 000001e8 ........... 1 ....
                ; ......
           1f0: e3dbe3db e3dbe3db 2a506f6c 616e642a ........ * Poland *


     Original test by Heiner Schneegold
     Translated from german to english by Google translate
     

     


Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht.dk