Xcom Link Virus - Amiga Virus Encyclopedia


     Amiga Virus Encyclopedia
     Xcom Link Virus
     - Xcom-LVirus file link
             see. also HappyNewYear96
             from KS2.04: yes (version query on at least # 37)
       Reason for name: in the link part you can read uncoded:
                f00ab240 6d047001 4e757000 4e757863 ... @ m.p.Nup.Nuxc
                6f6d48e7 omH. ^^
                 ; ..... ^^
                0029646f 732e6c69 62726172 7900abcd.) Dos.library ...
             Bent vector: LoadSeg
             Resetfest: No.
             File extension: 576 bytes
             Link behind the first hunk.
             Test whether LoadSeg is already bent
             Activation dependent on $ DFF006 and $ DFF00A (new)
             VT tries to reset Loadseg in memory.
             VT tries to remove the link part from a file.
       Propagation conditions:
            - File is not yet contaminated (1 LW test)
            - Filename does not contain ".l" or "-"
            - Max. File length # 124,000 bytes
            - min. File length # 2400 bytes
            - 3E9 hunk is found
            - Disk validated
            - At least 4 blocks free
            - RTS is found (max.loop $ 3F)
            - RTS is replaced by bra.s or NOP
            Skips 3E8,3F0,3F1-Hunks etc. !!!!!
            The part does not respond.
             If your HD is very contaminated, please start with
             the C-dir. (File Storage File). The frequent rereading
             this will decrease.

     Original test by Heiner Schneegold
     Translated from german to english by Google translate


Virum Help Team
Denmark & Canada
Copyright © All rights reserved