Amiga Virus Encyclopedia
LOBO Weird Link Virus
- LOBO weird virus link virus
In the decoded link part you can read:
4c4f424f 77656972 642e48e7 808041fa LOBOweird.H ... A.; ....
4e732041 4e54492d 56495220 50415443 Ns ANTI-VIR PATC
48206279 204d415a 45273937 21204eb9 H by MAZE'97! N.6 < a.
File extension: at least # 2100 bytes
Bent vectors: LoadSeg and TRAP (should now be variable)
- "LOBO" is not found
- Loadseg is bent into the ROM
- The TRAP command is searched for in ROM. The trap should now
be variable. It starts with TRAP0 ($ 4e40). In all
my ROMs will only become TRAP1 (see above at LOBOsimple)
- So it should be variably bent from $ 80 or VBR + $ 80.
So I always bend $ 84 or VBR + $ 84.
- with LoadSeg and TRAP
- File larger than # 7913 bytes
- File less than # 255600 bytes
- Medium validated
- no disc (at least # 91978 blocks)
- at least # 30 block free
- Filename does not contain ".", "-", "!", "VIR" or "vir"
- The virus part is always re-encoded with $ DFF006
- There are always contaminated files with 2 hunks
The 1st hunk contains the virus part. The 2nd hunk is the whole
Original File. Unfortunately you cannot just go back to the 2nd hunk
write because 8 bytes are encoded in the original file. It must
the coding longword is searched for in the virus section. This LW
always changes depending on $ DFF006.
Original test by Heiner Schneegold
Translated from german to english by Google translate