Denmark & Canada

Index - News - Download - Warnings - Link - Virus Help - About VHT - Encyclopedia - Miscellaneous - Contact

    Amiga Virus Encyclopedia
    Joshua 2 Virus

    - Joshua2-Virus    alternative names: Joshua3 or Switch-Off
      Cold, BeginIO, ExecVec5
      Has problems with a command in the C directory of WB1.3
      Bootblock is now encrypted:         loop: move.b (A0),D0
                                                eori.b #$18,D0
      The eor-byte changes and is located       move.b D0,(A0)+
      at position $3ff in the BB. Joshua2       cmpa.l A1,A0
      can be recognized by the end of the       bne loop
      BB where X is changed according to the    rts
      eor-byte: .XX...XXX........XX.XX.XXXX...X.XX.
      The dots can also be replaced by other characters.
      Remark 17.07.93: Recently, an increase in infections of BBs
      with Joshua2 has again been observed. Infecting an A600
      (WITHOUT memoryexpansion) resulted in a GURU (because of Vec5),
      but after a reset the virus was activated using COLD AND able
      to spread!

     Translated to English by Dennis Boon  2001 VHT-Denmark
     Org. Test by Heiner Schneegold.


Virus Help Team
Denmark & Canada
Copyright © 1994-2020