Amiga Virus Encyclopedia
LOBO Simple Link Virus
- LOBO simple virus link virus
In the decoded link part you can read:
ffff4e75 4e7a0801 4e734454 00000000 ..NuNz..NsDT ....; ....
2f480006 41fa050e 2081205f 4e733e4c /H..A .... _Ns> L
4f424f73 696d706c 653c4cdf 4eb900f9 OBOsimple < L.N ...; ....
7fff4a80 4e752323 506c695a 20646f6e .J.Nu PliZ don
74207368 6f6f7421 20492061 6d204e4f t shoot! I am NO
54206120 56495255 53212323 536e6f6f T a VIRUS! Snoo
70446f73 000041fa 04164c90 00ff6100 pDos..A ... L ... a.; ....
00086100 03604e75 3e62794d 415a4539 ..a..`Nu> byMAZE9
363c6100 6 < a.
File extension: # 1912 bytes
Bent vectors: LoadSeg and TRAP1
- Search for SnoopDos and DT (Debugger ??) see also note
if found, then end
- Loadseg already bent $ 4E41
- Loadseg is bent into the ROM
- the ROM is looking for the TRAP1 command 4e41 = "NA"
4e5d4e75 4e414d45 2c535452 494e472f N] NuNAME, STRING /
- $ 84 or VBR + $ 84 will be bent
- with LoadSeg and TRAP1
- Medium validated
- no disc (not enough blocks)
- At least # 30 block free
- Filename does not contain ".", "-", "!", "VIR" or "vir"
- The virus part is always re-encoded with $ DFF006
- Link as new first hunk ($ 1DA) in front of the original file
So the other hunks have to be reworked.
Since the virus part does not know very many types of host,
there are also defective files (proven in tests).
Note from a user Nov. 98: Thank you
DT is certainly DOSTrace by Peter Stuer
(e.g. at the Meeting_Pearls_III: Pearls / debug / Snooper / DOSTrace
or in AmiNet under util / moni) because:
1. DT is basically the same as SnoopDos
2. The file name (and thus the task name) of DOSTrace is im
Original archive DT
Original test by Heiner Schneegold
Translated from german to english by Google translate