Entry...............: H.N.Y.98
Alias(es)...........: Happy New Year 98
Virus detected when.: 1997/1998
              where.: -
Classification......: Link/boot virus, memory-resident, not reset-resident
Length of Virus.....: 1. Length on storage medium:
                                                  920 Bytes (files)
                                                  1024 bytes (bootblock)
                      2. Length in RAM:           3072 Bytes

--------------------- Preconditions ------------------------------------

Operating System(s).: AMIGA-DOS
Version/Release.....: 2.04 and above (V37+)
Computer model(s)...: all models/processors (MC68000-MC68060)

--------------------- Attributes ---------------------------------------

Easy Identification.: Text at the end of the first hunk:
                      "<> Happy New Year 98 <>"

Type of infection...: Self-identification method in files: 
                      -  Searches for "98" at offset -8 bytes
                         from the end of the first code hunk

                      Self-identification method in memory:
                      -  Checks for $0ca9 in the DoIO function

                      System infection: 
                      -  infects LoadSeg() of the dos.library
                      -  infects DoIO() of the exec.library

                      -  when executed from a bootblock temporarily
                         installs patch on OpenWindowTagList()
                         of intuition.library with code that will
                         infect the above mentioned vectors
                         (small delay)

                      Infection preconditions:
                      (LoadSeg)
                      - device has more than 4 free sectors
                      - file is longer than 2800 bytes
                      - file is shorter than 600000 bytes
                      - Hunk Code is found
                      - $4e75 is found at the end of the first CODEHUNK
                        or $4e75 is in the last $3f words of this hunk.
                      (DoIO)
                      - hardware check for write-protection succeeds
                      - bootblock is not infected already

Infection Trigger...: Accessing the volume
                       
Storage media affected: all DOS-devices

Interrupts hooked...: -

Damage..............: Permanent damage: 
                      - None
                      Transient damage: 
                      - None

Damage Trigger......: Permanent damage:
                      - None
                      Transient damage: 
                      - None

Particularities.....: This virus is mixture of classic link and bootblock
                      virus however it isn't reset resident and code
                      isn't optimised...

Similarities........: HNY96/97 + any bootblock viri from the past

Stealth.............: -

Armouring...........: Almost nothing. Some address relative commands,
                      this virus isn't even encrypted!

--------------------- Acknowledgement ----------------------------------

Location............: Pawlowice, Poland  12.2001
Classification by...: Zbigniew Trzcionkowski
Documentation by....: Zbigniew Trzcionkowski
Date................: 12.2001
Information Source..: Virus disassembly
Copyright...........: This documentation is public domain

===================== End of [HNY98] ====================================