------------------------    
     Amiga Virus Encyclopedia    
     EF67A3C3 link virus 
     ------------------------


     Virus Help Team are looking for this virus, please send it to us
     
    
     Name         : EF67A3C3

     Aliases      : No Aliases

     Original     : -

     Type         : Link virus
     
     Size         : 1392 bytes

     Symptoms     : Corrupted vector LoadSeg

     Discovered   : -

     Way to infect: Memory integration via LoadSeg
                    This is done via the longword $EF67A3C3.
                    Checks wheather the part is already active in memory.
                    
                    Link to a file:
                    Medium not WriteProtected (very old ??? Disk ???)
                    File executable (3F3)
                    CodeHunk (3E9) is found
                    NO test for specific file lengths
                    NO test for letters in the filename
                    File not yet infected (test with EF67A3C3)
                    A counter cell ensures that not every LoadSeg call results in a link attempt.
                    The part links itself as the new 1st hunk before the original 1st hunk.
                    Therefore, the part must also change the relocs of the following hunks.
     
     Rating       : Dangerous

     Kickstarts   : 1.2
                    1.3
                    2.0
                    3.0

     Damage       : -

     Visible text : -

     Comments     : A counter cell ensures that not every LoadSeg call results in a link attempt.
                    The part links itself as the new 1st hunk before the original 1st hunk.
                    Therefore, the part must also change the relocs of the following hunks.
                    The part also needs a reloc hunk for itself.
                    The 3E9 identifier of the original 1st hunk is changed to 3EA .

     Test made by : Heiner Schneegold

     Virus Help Team are looking for this virus, please send it to us