Christmas Linkvirus: --------------------- The infected file becomes 1056 bytes longer. The virus adds a hunk to the infected file. The virus does only work, if you have Ranger memory from $C00000-$C80000 because the virus uses direct memory adresses in this range and at the end of the first 512 kbyte chip memory. Example: cmpi.l #$0007E07A,$00C002A4.L ; 2 Direct memory adresses ; in one assembler command beq.b L_2 nop lea L_8C(pc),a0 lea $0007FB84.L,a2 move.w #$0400,d0 .loop move.b (a0)+,(a2)+ ; The CopyLoop dbra d0,.loop move.l #$0000633A,$0007FE80.L L_2: The only visible text in the virus is: > Generation: 0000 <. Other textparts are not visible. DC.B 'Nu > Generation: 008 <',0 The repair routine was only tested with one file because I did not succeed in spreading the virus on my test disks. Does anyone has an infected file which is longer then 2000 bytes? I need now your help/support. Detection and Repairroutine tested on 01.01.1993. Test by Markus Schmall [Go back]