QRDL V1.1 Linkvirus:
        This virus makes an infected file 2300 bytes longer.  It creates an
        own  first  hunk  (like  the  "classic"  viruses  like CCCP, Smilie

        The  CoolCapture  is set sometimes.  The following pointers will be
        - Exec: DoIO / NewOpenLibrary
        - Intuition: OpenWindow (-$CA)
        - $78 (Exec)

        Called this way because of a little ASCII text in the virusfile.

        Sometimes  the bitmap of the just inserted disk will be filled with
        $FFFFFF.   This  routine  will only be started if an old filesystem
        disk  (DOS0)  will  be used.  The result is that the OS thinks that
        the  disk is empty and if you write on the disk, all other files on
        disk became cleared.

        Disassembled code:

                move.l        #$00000370,d0                ; 880 = Rootblock
                move.w        #$007F,d1
        .loop        move.l        #$FFFFFFFF,(a0)+        ; fill with -1
                dbf        d1,.loop
                move.l        #$0000007F,(a3)
                move.w        #$0002,$001C(a1)        ; TD " WRITE "
                jsr        -$01a8(a6)
                move.l        #$00000200,d0
                jsr        -$00D2(a6)

        sector:        move.l        #$00000200,$0024(a1)
                mulu.w        #$0200,d0

        It is possible that infected files will not work anymore because of
        a  bad  hunk  detection routine in the virus.  I cannot rescue such
        files at the moment.

        The repair routine has only been tested on one file because I could
        not spread the virus on my disks!

                              Detection and termination tested on 21.11.92.

        Test by Markus Schmall...

[Go back]