VIRUS HELP TEAM
Denmark & Canada


Index - News - Download - Warnings - Link - Virus Help - About VHT - Encyclopedia - Miscellaneous - Contact



    ------------------------
    Amiga Virus Encyclopedia    
    Christmas Link Virus
    ------------------------

 
    Christmas Linkvirus:
 
    The infected file becomes 1056 bytes longer.  The virus adds a hunk
    to the infected file.  The virus does only work, if you have Ranger
    memory  from  $C00000-$C80000  because the virus uses direct memory
    adresses  in  this range and at the end of the first 512 kbyte chip
    memory.

    Example:

    cmpi.l        #$0007E07A,$00C002A4.L        ; 2 Direct memory adresses
                                              ; in one assembler command
    beq.b        L_2
      nop
      lea        L_8C(pc),a0
      lea        $0007FB84.L,a2
    move.w        #$0400,d0
     .loop        move.b        (a0)+,(a2)+                ; The CopyLoop
      dbra        d0,.loop
    move.l        #$0000633A,$0007FE80.L
       L_2:


    The only  visible  text  in  the virus is:  > Generation:  0000 <.
    Other textparts are not visible.

               DC.B        'Nu > Generation: 008 <',0


    The  repair routine was only tested with one file because I did not
    succeed  in  spreading the virus on my test disks.  Does anyone has
    an  infected file which is longer then 2000 bytes?  I need now your
    help/support.


                       Detection and Repairroutine tested on 01.01.1993.

    Test by Markus Schmall


    

Virus Help Team
Denmark & Canada
Copyright © 1994-2020