(c) Copyright 1989-1999 Amiga, Inc. All rights reserved. The information contained herein is subject to change without notice, and is provided "as is" without warranty of any kind, either expressed or implied. The entire risk as to the use of this information is assumed by the user. THE AMIGA VIRUS Bill Koester Definition ---------- The Amiga virus is simply a modification of the boot block of an existing DOS boot disk. Any disk that can be used to boot the Amiga (ie workbench) has a reserved area called the boot block. On an Amiga floppy the bootblock consists of the first two sectors on the disk. Each sector is 512 bytes long so the boot block contains 1024 bytes. When KickStart is bringing up the system the disk in drive 0 is checked to see if it is a valid DOS boot disk. If it is, the first two sectors on the disk are loaded into memory and executed. The boot block normally contains a small bit of code that loads and initializes the DOS. If not for this boot code you would never see the initial CLI. The normal boot code is very small and does nothing but call the DOS initialization. Therefore, on a normal DOS boot disk there is plenty of room left. The virus is a replacement for the normal DOS boot code. In addition to performing the normal DOS startup the virus contains code for displaying the virus message and infecting other disks. Once the machine is booted from an infected disk the virus remains in memory even after a warm start since the warm start routine is "infected" too. Instead of going through the normal startup, the virus checks the boot disk in df0: for itself. If the virus in memory sees that the boot block is not infected it copies itself onto the boot block over-writing any code that was there before. It is in this manner that the virus propagates from one disk to another. After a certain number of disks have been infected the virus will print a message telling you that "something wonderful" has happened. Dangers ------- When the virus infects a disk the existing boot block is over-written. Since some commercial software packages, especially games, store special information in the boot block the virus could damage these disks. When the boot block is written with the virus, any special information is lost forever. Mechanics --------- Here is a more detailed description of how the virus works - please use this information for learning and understanding only. Do not use it to create more virus problems in the Amiga community. Infiltration This is the first stage of viral infection. The machine is brought up normally by reading the boot block into memory. When control is transferred to the boot block code, the virus code immediately copies the entire boot block to $7EC00. It then JSR's to the copied code to wedge into the CoolCapture vector. Once wedged in, control returns to the loaded boot block which performs the normal DOS initialization. Control is then returned to the system. Hiding Out At this point the system CoolCapture vector has been replaced and points to code within the virus. When control is routed through the CoolCapture vector the virus first checks for the left mouse button, if it is down the virus clears the CoolCapture wedge and returns to the system. If the left mouse button is not pressed the virus replaces the DoIO code with its own version of DoIO and returns to the system. Spreading The code so far has been concerned only with making sure that at any given time the DoIO vector points to virus code. This is where the real action takes place. On every call to DoIO the virus checks the io_Length field of the IOB if this length is equal to 1024 bytes then it could possibly be a request to read the boot block. If the io_Data field and A4 point to the same address then we know we are in the strap code and this is a boot block read request. If this is not a boot block read the normal DoIO vector is executed as if the virus was not installed. If we are reading the boot block we JSR to the old DoIO code to read the boot block and then control returns to us. After reading, the checksum for the virus boot block is compared to the checksum for the block just read in. If they are equal this disk is already infected and the code returns. If they are not equal a counter is incremented and the copy of the virus at $7EC00 is written to the boot block on the disk. If the counter ANDed with $F is equal to 0, then a rastport and bitmap are constructed and the message is displayed. The Message < Something wonderful has happened > < Your AMIGA is alive!!! > < and even better > < Some of your disks are infected by a VIRUS > < Another masterpiece of the Mega-Mighty SCA > Prevention ---------- How do you protect yourself from the virus? 1) Never warm start the machine, always power down first. This works but is not very practical. 2) Always hold down the left mouse button when rebooting. This also works, but only with the current SCA virus since it checks for mouse presses. Future viruses may not. 3) Obtain a copy of VCheck1.2 and check all disks before use. VCheck1.2 is posted on Usnet and BIX. 4) If you can't get a copy of VCheck, then use a sector editor like SectORama (Fish Disk #108, #102) to check the boot block for virus text. Treatment --------- The virus can be removed from an infected disk by using the DOS Install command which will put standard boot code in the boot block. Be careful though, the Install command will over-write any code that was there. You should only use Install on a DOS boot disk. Applications, especially games, may have a custom boot block which will be destroyed by the Install command. If you have an infected game disk, then chances are the boot block is already corrupted so you have nothing to lose by trying the Install command. You could s also try returning the disk to the publisher for a new copy if they have a policy of replacing faulty disks. If you do this, clearly mark the disk with the word virus so no one else is infected.