AramDol Link Virus - Amiga Virus Encyclopedia


   Amiga Virus Encyclopedia
   AramDol Link Virus
   - AramDol-Virus      File  Link

         cf. xcom-LVirus, HappyNewY.96
         Minimum version KS2.04: Queries on  Aram-Dol <(..
            646f732e 6c696272 61727900 000003ef dos.library.....
         Changed vectors: LoadSeg LastAlert
         Survives reset: No
         File lengthened by: 560 Bytes
         Link after the first hunk.
         VT tries to reset LoadSeg.
         VT attempts to remove the link-virus from the file.
         Method of staying in memory:
           - LastAlert (FFFFF3EC) may not have been changed
           - LoadSeg changed
           - File is not yet contaminated (Test 3EF)
           - Filename contains neither ".l" nor "-"
           - max. filelength ~80000 Bytes
           - min. filelength ~3000 Bytes
           - 3E9 hunk is found (Loop)
           - Disk validated
           - At least 4 blocks free
           - RTS is found ( max. loop $3F )
           - RTS replaced by bra.s or NOP (if RTS is at the end of the
             original first hunk)
         Skips over 3E8,3F0,3F1 hunks etc. !!!!!
         The part doesn't report itself.
         If your hard drive is very contaminated, then please begin with
         C-Verz. (File-Memory-File). By doing this, the ????

         Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                  Kickstart all others: VirusZ III with Xvs.library installed

    Translated to English by Antonio Remedios © 2001 VHT-Denmark
    Org. Test by Heiner Schneegold.


Virum Help Team
Denmark & Canada
Copyright © All rights reserved