delton@pro-carolina.cts.COM (Don Elton) (07/24/88)
Files infected by the prodos based virus I mentioned earlier start with the
following code sequence:
jmp relocate
relocate jsr $ff58
tsx
etc etc etc
This means that you can use a block editor with a hex search feature and look
for the string 20 58 FF BA BD to identify blocks containing the virus
relocator code.
UUCP: [ ihnp4 sdcsvax nosc ] !crash!pro-carolina!delton
ARPA: crash!pro-carolina!delton@nosc.mil
INET: delton@pro-carolina.cts.com
Pro-Carolina: 803-776-3936 (300-2400 baud, login as 'register')
US Mail: 3207 Berkeley Forest Drive, Columbia, SC 29209-4111