textfiles/virus/amigvir2.txt

AMIGA VIRUS

By ED EARING

Although I am not an owner of an Amiga, and although I am not familiar with
much of AmigaDOS, I have read the following disturbing subject in a
couple of other user group publications. I will attempt to make
this report with findings gathered from articles authored by Larry Phillips
(Commodore Users of Bartlesville) and Jo-Ann Nemeth (Commodore Users Group of
Columbus, Ohio).
     If you see this message appear:  "Something wonderful has happened. Your
Amiga is alive!!!"  Please become very concerned.
     A European group called Swiss Cracking Association (SCA) is taking
the credit for this latest form of invasion.
     The usual chain of events is this:

     An Amiga is booted with an infected disk. All works normally, with
no sign that anything is amiss.  If you then reboot the machine with
Ctrl-Amiga-Amiga key, using an uninfected disk, the virus is
transmitted to the boot disk and it too becomes a "carrier," ready to pass it
on again, and so on.
     If you have received any copies of programs from anyone ... user group,
friends, bulletin boards ... whatever, it is imperative that you test these
disks BEFORE doing a warm reboot.
     So how do you know if your disks are infected already? What do you do?
     Bill Koester of Commodore, Inc., has written a program, VCHECK, that
will determine whether a specific disk is indeed infected. The virus writes
to block 0 (zero), and one track 1 (0-1, 1-1). This is the same area used by
some commercial programs to record important disk information. The result
can be the destruction of the commercial program's usefulness. VCHECK
tests your computer's memory to see if it is infected with the virus.

     As a safeguard, until you are able to test your disks, do NOT use an
important and presumedly uninfected disk unless the disk is write protected
before you put it into the drive or if this is not possible, turn the Amiga
off for a minimum of 60 seconds and then on again. To erase the SCA
jokesters' little humor, do an INSTALL of an infected disk from AmigaDOS. The
problem with this procedure is that it rewrites blocks zero, and commercial
programs often use block zero for copy protection so an "Install" could ruin
the program.
     Using a program like SECTORAMA (DiskZAP will not show it), look at
Block 1 (cyl 0, hd 0, sec 1). If the virus is present, then run INSTALL.
Then turn the power off/on. If you have booted from an infected disk, and have
used INSTALL to kill the virus (see above), rebooting WITHOUT powering
off/on will only reinfect the disk.
     Instructions for 2 drives:
     Use Kickstart 1.2 (Amiga 500 already has 1.2 built in). When the
Workbench prompt appears, place your disk with the virus check program in
drive DF0:. This disk will automatically check your current memory. If your
memory is clear of the virus proceed. If not, turn off the Amiga for at least
60 secnds and start the procedure over.
     Next, place the suspect disk in drive (either DF1: or DF2: for the A2000)
and type at the "1>" prompt:  vcheck1 (return).
     If all is well, you will see this message:  "Virus Check 1.0 by Bill
Koester (CATS). This disk is healthy." If not, you are told that this disk
has the virus. Then type at the "1>" prompt: install df1: (return).
     Should you find that your copy of Workbench is infected, then type at the
"1>" install df1: (return). Now turn the power off/on for the 60 second
 interval.
     The best advice the writers give is when you receive a new disk place it
in a special place and do NOT use it until you have a chance to test it for
the virus. They include commercial disks in this warning.
     I read that the virus-checking program should be on Quantum Link or
GEnie or perhaps some Amiga BBS's. If you have the programs, it would be a
good idea to donate them to your SIG library.
     NMCUG Editor's Note: The virus has been found on beta-test (i.e.,
pre-release not totally debugged) versions of commercial software, so it
is possible it could appear on brand-new just-out-of-the-box commercial
disks. Supposedly commercial software publishers are rectifying this
situation.
---------------------
Reprinted from COMMODORE DIMENSIONS,
January 1988, published by New Mexico
Commodore User's Group, P.O. Box 37127,
Albuquerque, NM 87176.

---------------------
Some further notes:  this text file was written some one-and-a-quarter years
ago, by my time (4/89), and although the information given within is more or
less correct, it is outdated.  Since the SCA virus emerged, a slew of others
have appeared, most of which use the same methods to spread themselves (boot
block infection).  I will not go into the specifics of these new viruses, but
would recommend that interested parties (ALL Amiga users) get a copy of Steve
Tibbet's program VirusX and read the accompanying documentation, which
goes into more detail about the different viruses.  VirusX should be available
through your local Amiga user group or from the Fred Fish collection of disks.

Some BBSes to call:
 
Digit Mail Box (408) 258-5463 3/12/2400b 8N1 Milpitas, CA.  BBS of 64/More
     Commodore User Group.
HomeBase BBS (408) 988-4004 3/12/2400b 8N1 Santa Clara, CA.  SysOp John D.
     McAfee head of Computer Virus Industry Association.
OMX BBS (613) 731-3419 3/12/2400b 8N1 Ottawa, Canada.  SysOp Steve Tibbet,
     author of VirusX.