------------------------
Amiga Virus Encyclopedia
Xcom Link Virus
------------------------
- Xcom-LVirus file link
see. also HappyNewYear96
from KS2.04: yes (version query on at least # 37)
Reason for name: in the link part you can read uncoded:
f00ab240 6d047001 4e757000 4e757863 ... @ m.p.Nup.Nuxc
6f6d48e7 omH. ^^
; ..... ^^
0029646f 732e6c69 62726172 7900abcd.) Dos.library ...
^^^^^^^^
Bent vector: LoadSeg
Resetfest: No.
File extension: 576 bytes
Link behind the first hunk.
Test whether LoadSeg is already bent
Activation dependent on $ DFF006 and $ DFF00A (new)
VT tries to reset Loadseg in memory.
VT tries to remove the link part from a file.
Propagation conditions:
- File is not yet contaminated (1 LW test)
- Filename does not contain ".l" or "-"
- Max. File length # 124,000 bytes
- min. File length # 2400 bytes
- 3E9 hunk is found
- Disk validated
- At least 4 blocks free
- RTS is found (max.loop $ 3F)
- RTS is replaced by bra.s or NOP
Skips 3E8,3F0,3F1-Hunks etc. !!!!!
The part does not respond.
Note:
If your HD is very contaminated, please start with
the C-dir. (File Storage File). The frequent rereading
this will decrease.
Original test by Heiner Schneegold
Translated from german to english by Google translate