******************* V I R U S  K I L L I N G  P A R T ********************
centurion:
	move.l		$04.w,a6
	move.l		550(a6),d0
	beq.s	cen_exit
	move.l		d0,a0
	move.l		30(a0),a1
	lea		cen(pc),a0
	moveq		#3,d0
cen1:	cmpm.l		(a0)+,(a1)+		; the first four longs
	dbne		d0,cen1			; of his code..
	tst.w		d0
	bpl.s	cen_exit
	move.l		-610(a6),a0	
	cmp.l		#$7f0fe,a0
	bne.s	cen_exit
	lea		$7fdf0,a0		; is his save back
	move.l		(a0),-610(a6)		; pointer..
	bsr.L	tracker
	lea		$7fdf4,a1		; restore
	move.l		(a1),(a0)		; trackdisk.device
	bsr.L	clear_kicktag			; throw resident out
	lea		$7f000,a0
	bsr.L	filler				; clears memory
	lea		$7f400,a0
	bsr.L	filler				; clears memory
	move.w		#$1941,virusflag
	move.l		#mes16,d2
	move.l		#mes16length,d3
	bsr.L	writer1
cen_exit:
	rts
	
cen:	dc.l	$4eaeff88,$60b241fa
	dc.l	$0d00202e,$02266712
**************************************************************************
*
*	CENTRUION - LINK VIRUS
*
*	makes himself resident, changes the DOIO & KICKSUM.
*
*	Virus is 3916 bytes long and tries to infect the programs in
*	the startup-sequence.
*	After XX resets he changes the mousepointer to a smiley with a
*	little scroller.
*
***************************************************************************
Disaster_Master:
	move.l		$04.w,a6
	move.l		550(a6),d0
	beq.s	disaster_exit
	move.l		d0,a0
	move.l		(a0),a0
	cmp.w		#$4afc,(a0)+	; isses denn RESIDENT???
	bne.s	disaster_exit
	move.l		(a0)+,a2
	move.l		(a0)+,a1		
	sub.l		a2,a1
	cmpa.l		#$1e,a1		; is immer seine struct laenge
	bne.s	disaster_exit
	move.l		(a0),d0
	cmp.l		#$01210873,d0	; sind seine flags
	bne.s	disaster_exit
	add.l		#12,a0	
	move.l		(a0),a0
	move.l		a0,a2		; backsave
	add.l		#8,a0
	move.l		(a0),d0
	cmp.l		#$011cd7c0,d0	; teil seines codes	
	bne.s	disaster_exit
	move.w		#$4e75,(a2)	; castrated	
	move.l		a2,a0
	add.l		#$14a,a0
	move.l		(a0),-454(a6)	; rauswerfen
	bsr.L	clear_kicktag
	move.w		#$1941,virusflag
	move.l		#mes14,d2
	move.l		#mes14length,d3
 	bsr.L	writer1
disaster_exit:
	rts

**************************************************************************
*
*	DISASTER-MASTER V2	FILE VIRUS
*
*	makes himself resident and changes the DOIO.
*
*	Virus is 1740 bytes long, his name is 'CLS' and is
*	found in the 'C' Dir.
*	When he has infected a disk, he is always the first command
*	in the startup-sequence -> 'CLS *'
*	If you execute him he will clear screen, but if you execute him
*	with 'CLS *' he will do nothing. Looks like a option!
*	Infects everything with 's/startup-sequence' even harddisks.
*
***************************************************************************

* here begins the part taken from VIRUSX4.0 by STEVE TIBBET

;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;
;	Check for and Remove the Xeno Virus
;
;:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

xeno:
	move.l	DOSBase,a0		; Get addr of Open() Vector
	sub.w	#$1c,a0
	move.l	(a0),a0

	move.l	a0,d0			;: If Bit 0 of the Address is set,
	btst	#0,d0			;: then it's not really an address
	bne.s	NoVirus_xeno		
	
	cmp.l	#$B47C03EE,(a0)
	bne.s	NoVirus_xeno
	cmp.l	#$67000224,4(a0)
	bne.s	NoVirus_xeno

	;:: If we're here, we're fairly sure A0 is pointing to the
	;:: base of the Xeno virus (well, not it's base, but the address
	;:: of the first vector it stole, the Open() one.
	;:: So we'll nuke it.  8-)

	move.w	#$6000,$4(a0)
	move.w	#$603E,$240(a0)
	move.w	#$601E,$29C(a0)

* END OF PART

	move.w		#$1941,virusflag
	move.l		#mes13,d2
	move.l		#mes13length,d3
 	bsr.L		writer
NoVirus_xeno:
	rts

; i hate to do this, but until now i never got a xeno virus and was
; therefore not able to do my own killer.
; in addition to that: I HATE THE WAY S.TIBBET KILLS VIRUSES!!!!!!!
; it is not very intelligent to look for a checksum....

revenge:
	move.l		$04.w,a6
	cmp.l		#$7e060,46(a6)
	bne.s		revenge_ende
	move.l		$c0,d0
	cmp.l		#$0c794ef9,$c0
	bne.s		revenge_ende

	move.l		$7e068,-454(a6)	; restoring the old pointers
	move.l		$7e06e,148(a6) 	; by grabbing his saved systemcalls

	lea		$7e000,a0	; the virus
	bsr.L		filler

	lea		$c0,a0		; CLEAR
	moveq		#0,d0		; his routine
	moveq.l		#$10,d6		; located at $c0
rev1:
	move.l		d0,(a0)+
	dbf		d6,rev1

	bsr.L		killcold_cool	; out of memory!! HE HE..

	move.w		#$1941,virusflag
	move.l		#mes12,d2
	move.l		#mes12length,d3
 	bsr.L		writer1
revenge_ende:
	rts

*************************************************************************
* REVENGE is a stupid one, it copies a small CONTROLLER part down to
* $c0 and is ALWAYS located at $7e000. (No interest in Fast Mem!!) 
* I only added this one, because it was easy and BERSERKER III crashed
* when REVENGE was in memory. (uses cold cap., 148(a6) & -454(a6) DOIO)
*************************************************************************

revenge_boot:	; seems to be a brand new one...
	bsr.L		tracker
	move.l		a0,revenge1
	move.l		(a0),d4
	swap		d4
	cmp.b		#$fe,d4		; Is this pointer normal? (V1.2)
	beq.L		revenge_boot_ende
	cmp.b		#$ff,d4		; Is this pointer normal? (V1.3)
	beq.L		revenge_boot_ende

	move.l		$4.w,a6		; using his own check
	moveq		#0,d0		; routine... 
	move.w		$94(a6),d0
	and.l		#$f0,d0
	cmp.w		#$f0,d0
	beq.L		revenge_boot_ende	; not in memory

	move.l		(a0),a1
	add.l		#$228,a1
	move.l		(a1),revenge_track	; -28(trackdisk.device)
	add.l		#$4,a1
	move.l		(a1),revenge_rast	; 148(a6)
	add.l		#$4,a1
	move.l		(a1),revenge_alloc	; the part he spreads
	sub.l		#$3c4,a1
	move.l		a1,revenge_mem		; his own start

	move.l		revenge1,a0		; restoring pointers
	move.l		revenge_track,(a0)

	move.l		revenge_rast,$94(a6)		

	bsr.L		clear_kicktag

	move.l		revenge_mem,a0
	bsr.L		filler

	move.l		revenge_alloc,a0
	bsr.L		filler

	move.l		revenge_alloc,a1	; he allocatesw memory..
	move.l		#$400,d0		; ani i give it back...
	jsr		freemem(a6)

	move.w		#$1941,virusflag
	move.l		#mes11,d2
	move.l		#mes11length,d3
 	bsr.L		writer1
revenge_boot_ende:
	rts

*************************************************************************
*
* seems to be a new one -> contains ASCII Text 'REVENGE BOOTLOADER' 
*
*************************************************************************

disk_doctor:
	move.l		$04.w,a6	; Disk-Doc uses cold & cool capture
	move.l		46(a6),d0
					; No other virus uses both
	beq.L		dd0		; pointers... [ hope so !!! ]
	move.l		42(a6),d0
	beq.L		dd0

	move.l		42(a6),diskdoc	; I had to add this very
	move.l		diskdoc,a0	; complicated routine because
	add.l		#$c4,a0		; Disk-Doc uses or changes:
	move.l		a0,a1		; - cool capt.
	addq.l		#4,a1		; - cold capt.
	move.w		#$4e75,(a1)	; - DoIO
	jsr		(a0)		; - 148(a6) [what's that?]
	move.l		a2,diskdoc1	; - The task of clipboard.device
	addq.l		#6,a2
	move.l		a2,a3		; This routine gets the adress of
	addq.l		#4,a2		; its task routine and cuts it off
	move.w		#$4e75,(a2)
	jsr		(a3)
	move.l		a0,diskdoc2
	bsr.L		killcold_cool
	move.l		$04.w,a6
	move.l		#$fc06dc,-$1c6(A6); Only Kick 1.2 values, on 1.3
	move.l		#$fc12fc,148(a6)  ; Disk-Doc shouldn't work...

	move.l		diskdoc,a0
	move.l		a0,a1
	add.l		#$1a0,a1
	moveq		#0,d0
dd2:	move.l		d0,(a0)+
	cmpa.l		a0,a1
	bge.s		dd2
	move.l		diskdoc1,a2
	move.w		#$4e75,(a2)
	move.l		diskdoc2,a2
	move.w		#$4e75,(a2)

	move.w		#$1941,virusflag
	move.l		#mes6,d2
	move.l		#mes6length,d3
 	bsr.L		writer1
dd0:	rts

***********************************************************************
*
*	DISK-DOCTOR
*
*	- After each reset Disk Doctor allocates more memory
*	- This was in my opinion the best one, although it could be
*	  better: - it uses DoIO pointer from Kick 1.2 (crash on 1.3)
*		  - you can read text in the boot-block
*	- it uses the clipboard task for its dirty work
*	- it uses cold & cool capture to stay in memory
*
*	For such kind of virus Guardian or VirusX are the best killers!!
*	( Find them in the boot and fight them when they are harmless! )
*	Same with TIMEBOMB, Berserker can't fight this one........
************************************************************************

gadaffi:
	move.l		$04.w,a6	; Gadaffi uses cool capture
	cmp.l		#0,46(a6)	; for its dirty work...
	beq.s		gad0		; no cool capture set

	cmp.l		#$47414441,$7fb40; Gadaffi
	bne.s		gad0		; is ALWAYS to be found at $7fb00

	move.l		-$1c6(a6),d5	; $4b0 with 512 kb
	swap		d5
	cmp.w		#$fc,d5		; $fc06dc (1.2)  $fc0718 (1.3)
	beq.s		gad0

	move.l		46(a6),gadaf
	bsr.L		killcold_cool	; Clear its cool pointer
	move.l		$04.w,a6
	move.l		#$fc06dc,-$1c6(A6)

	bsr.L		clear_kicktag

	move.l		gadaf,a0
	sub.l		#$dc,a0
	bsr.L		filler
	move.w		#$1941,virusflag
	move.l		#mes4,d2
	move.l		#mes4length,d3
 	bsr.L		writer1
gad0:	rts

********************************************************************
*
*	GADAFFI is a mutant version of Byte Warrior
*
*	- It changes cool capture, kicktag. and DoIO
*	- It is much more stupid than Byte Warrior:
*	 -> you can read it in the boot...
*	 -> normally it crashes with Kick 1.3 because
*	    he uses the DoIO vector of 1.2 itself
*	- After 12 resets it tries to kill your drive, or
*	  was it playing a drive music ?? (I don't see any difference!)
*
********************************************************************
bsg:
	move.l		$04.w,a6
	move.l		546(a6),d0	; BSG 9 is a resident module
	adda.l		550(a6),d0	; It is still in memory after
	adda.l		554(a6),d0	; a reset
	beq.s		bsgende
	move.l		550(a6),a0	; Searching from A0
	move.l		a0,a1
	add.l		#$1000,a1	; Searching to A1
	move.l		#$00005454,d0	; Searching for 'TT'
	moveq		#0,d1
bsg0:
	move.w		(a0)+,d1
	cmp.w		d1,d0
	beq.s		bsg1
	cmpa.l		a0,a1
	bge.s		bsg0
	rts				; Nothing found !
					; It is not always a virus which
					; uses these pointers. It could
bsg1:					; also be your ramdrive....
	move.w		#$5631,d0
	move.w		(a0),d1
	cmp.w		d1,d0
	bne.s		bsg0
	moveq		#0,d0		; Kills it from beginning
	move.l		a0,a1		; to 'TTV1' <- its end marker
	move.l		550(a6),a0
bsg2:
	move.l		d0,(a0)+
	cmpa.l		a0,a1
	bne.s		bsg2

	bsr.L		clear_kicktag

	move.w		#$1941,virusflag
	move.l		#mes2,d2
	move.l		#mes2length,d3
 	bsr.L		writer
bsgende:
	rts

********************************************************************
*
*	BSG 9 is an intelligent version of a link virus
*
*	- It always modifies the FIRST file of the startup-
*	  sequence
*	- The file now always is about 2608 bytes long
*	- The old file in in the devs dir with
*	  spaces instead of a name now
*	- After the fourth or fifth reset it turns the
*	  screen black and prints out its stupid message.
*
*********************************************************************

irq:	; changes oldopen
	move.l		$04.w,a6
	move.l		-$196(a6),d4
	swap		d4
	cmp.b		#$fc,d4	; V1.2 00fc1430  V1.3 00fc146c
	beq.s		irq5
	move.w		#$1942,virusflag
	move.l		-$196(a6),a4
	add.w		#8,a4
	move.l		#$4e714e71,(a4)	; Castrate virus
	move.l		$04.w,a5
	sub.l		#$196,a5	; In this part the old
	move.l		(a5),a4		; oldopenlib call
	add.l		#18,a4		; is restored...
	move.l		(a4),(a5)
	move.l		#mes3,d2
	move.l		#mes3length,d3
	bsr.L		writer
irq5:	rts

**************************************************************
*
*	The IRQ Team Virus was the first link virus
*	on AMIGA...
*
*	It uses oldopenlibrary for its dirty work.
*	In order to work properly with all Kickstart
*	versions the IRQ-virus saves the replaced
*	sytemcall in memory.
*	To let my Berserker work with all kick versions
*	I just grab his saved sytemcall in order to
*	throw him out properly...
*
**************************************************************

exterminator:	; in trddevice, doio & kicktag... ($4678, $414, $898)
	bsr.L		tracker
	move.l		a0,exter
	move.l		(a0),d4
	swap		d4
	cmp.b		#$fe,d4		; Is the pointer normal (V1.2)
	beq.L		exe4
	cmp.b		#$ff,d4
	beq.L		exe4		; Is the pointer normal (V1.3)

	move.l		a6,a5
	sub.w		#$262,a5	; In A5 now Exterminator's address..
	move.l		a5,exter1
	move.l		(a5),d4
	swap		d4
	cmp.b		#$fc,d4		; Is it the normal system call?
	beq.s		exe4

	move.l		exter1,a5
	move.l		(a5),a0
	sub.l		#$14e,a0
	move.l		a0,a1
	add.l		#$400,a1
	moveq		#0,d1
	moveq		#0,d0
exe7:
	move.w		#$4c41,d0	; We are looking for 'LAMER'
	move.w		(a0)+,d1
	cmp.w		d1,d0
	beq.s		exe2
	cmpa.l		a0,a1
	bge.s		exe7
	rts
exe2:
	move.w		#$4d45,d0
	move.w		(a0),d1
	cmp.w		d1,d0
	bne.s		exe7
	add.l		#28,a0		; Here exteminator saves his
	move.l		(a0)+,a1	; changed system calls
	move.l		(a0)+,a2

	move.w		#$1941,virusflag

	bsr.L		clear_kicktag

	move.l		exter1,a0	; Correct both pointers
	move.l		a1,(a0)
	move.l		exter,a0
	move.l		a2,(a0)
	move.l		exter1,a5	; Crucify it
	move.l		(a5),a0
	sub.l		#$14e,a0
	bsr.L		filler
	move.l		#mes9,d2
	move.l		#mes9length,d3
	bsr.L		writer1
exe4:	rts

***********************************************************************

sca:
	move.l		$04.w,a6
	move.l		46(a6),d2	; Cold-capture
	bne.s		sca1
	rts
sca1:
	move.w		#$1941,virusflag
	move.l		46(a6),a0
	move.l		a0,a1
	sub.l		#$3e,a0		; We are now searching
	add.l		#$400,a1	; for jsr -456(a6) [DoIO]
	moveq		#0,d1		; if cold capture is set
	moveq		#0,d0		; and in the routine is
sca2:					; a DoIO it is 100% a
	move.w		#$4eae,d0	; virus ( mostly mutants)
	move.w		(a0)+,d1
	cmp.w		d1,d0
	beq.s		sca3
	cmpa.l		a0,a1
	bge.s		sca2
	rts				; Nothing found
sca3:
	move.w		#$fe38,d0
	move.w		(a0),d1
	cmp.w		d1,d0
	bne.s		sca2
	move.l		$7eff0,d2	; Here is the direct test
	cmp.l 		#$53434121,d2	; if it is SCA or AEK or LSD
	beq.s		sca4		; if it is none of them it is
					; another mutant SCA...
	cmp.l		#$4c534421,d2	; AEK
	beq.s		scamutants
	cmp.l		#$41454b21,d2	; LSD
	beq.s		scamutants
	bne.s		scamutants
sca4:
	move.l		#mes5,d2	; SCA
	move.l		#mes5length,d3
 	bsr.L		writer1
	bra.s		scakill
scamutants:
	move.l		#mes8,d2	; Mutant
	move.l		#mes8length,d3
 	bsr.L		writer1
scakill:
	move.l		46(a6),a0
	sub.l		#$3e,a0
	bsr.L		filler
	bsr.L		killcold_cool	; Repairs both vectors
	rts

************************************************************************

dasa:
	move.l		$04.w,a6
	move.l		-$1c6(a6),d5	; $4b0 with 512 kb
	swap		d5
	cmp.w		#$fc,d5		; $fc06dc (1.2)  $fc0718 (1.3)
	bne.s		dasa0
	move.l		$7f804,d5	; Dasa is ALWAYS at $7f800
	cmp.l		#$64116dec,d5	; no need to restore doio
	beq.s		dasa1		; pointer (not changed)
	rts
dasa0:
	move.l		#$00fc06dc,-$1c6(a6)	; Remove its pointer
dasa1:	move.l		-$1c6(a6),a3
	sub.l		#$16e,a3	; Its beginning

	bsr.L		clear_kicktag

	move.l		#$4ff,d1	; Delete virus
dasa2:	move.b		d0,(a3)+
	dbf		d1,dasa2
	move.w		#$1941,virusflag
	move.l		#mes1,d2
	move.l		#mes1length,d3
	bsr.L		writer1
	rts

****************************************************************
*
*	DASA is the Byte Warrior
*
*	DASA is always located at $7f800 and since
*	it uses a direct jump for DoIO of kick V1.2
*	( jmp $fc06dc ) for his own copy-routines it
*	crashes on kick v1.3.
*	Therefore I have added this two way search, because
*	when it's kick 1.3 DASA can't work but is still in
*	memory and I don't like a virus in memory...
*
*		ONLY A DEAD VIRUS IS A GOOD VIRUS!!!!
*
***************************************************************

bytebandit:		    ; Searches for byte bandit

	bsr.L		tracker
	move.l		a0,bb1
	cmp.l		#$00f00000,a0
	ble.s		bytebandit1	; OK! DoIO is changed
	rts

bytebandit1:
	move.l		148(a6),a0	; Now second test if it
	cmp.l		#$00f00000,a0	; is really byte bandit
	ble.s		bytebandit2	; LAMER also changes DoIO!
	rts

bytebandit2:	; it is byte bandit!!
	move.l		a0,a4
	add.l		#$10c,a0	; Here the pointers are
	move.l		(a0)+,a1	; saved...
	move.l		(a0),a2
	move.l		bb1,a0
	move.l		a1,(a0)		; Restoring both
	move.l		a2,148(a6)	; pointers...

	bsr.L		clear_kicktag

	sub.l		#$2ca,a4	; Its beginning
	move.l		a4,a0
	bsr.L		filler

	move.w		#$1941,virusflag
	move.l		#mes10,d2
	move.l		#mes10length,d3
	bsr.L		writer1
	rts