@database "Virus Info Base"
@node main "Return Of The Lamer Exterminator"

     Name         : Return Of The Lamer Exterminator

     Aliases      : No Aliases

     Type/Size    : Disk-Validator/1848

     Clones       : No Clones

     Symptoms     : No Symptoms

     Discovered   : ?

     Way to infect: File infection

     Rating       : Very Dangerous

     Kickstarts   : 1.2/1.3

     Damage       : Overwrites original Disk-Validator

     Manifestation: -

     Removal      : Use good Viruskiller.

     Comments     : This  virus  is a very  nasty  one.  It owerwrites the
                    original  Disk-Validator and damages the Rootblock. If
                    you  are now inserting a infected disk DOS thinks that
                    the  disk  has an  error, so it loads the (fake) Disk-
                    Validator. Now theVirus does the following:

                 1) Copies  itself  in the  memory-adress which was before
                    calculated  with  $DFF006  register  and  the Memlist.

                 2) It  patches  the  DoIO()-Vector and the Close()-Vector
                    from  the  trackdisk.device.  This Vectors are used to
                    set  a  Rootblock-value   always  to  "Not-Validated".
                    Additionally   another  vector  will be patched by the
                    virus.  Calculated  with  the  Vertical  Blank-Vector.
                    -> $90(a6)


                 3) Furthermore  it uses the KICK-Vectors to stay resident
                    in the memory.

                    If  you  are  now  booting with an unproteced disk the
                    virus  tries  to  copy  itself  in  the L directory of
                    the  current  disk.  The  virus  jump  directly to the
                    DOS-functions. 

                    Sometimes  the  virus  fill s up a block on your disks
                    with the word "LAMER !!!".

                    And even worse:
                    Depending  of  a  special  value the virus formats all
                    disks in every drive and gives out an alert:

                    Click on this gadget to see a @{" Demo " SYSTEM " V-IFF:ReturnOfTheLamer} of the "Return of
                    the Lamer" alert. Push left mouse button to quit.

A.D 04-94
@endnode

