BYTE BANDIT 4 Virus (10-February-1991)
Entry...............: BYTE BANDIT 4 Virus
Alias(es)...........: ---
Virus Strain........: BYTE BANDIT strain
Virus detected when.: July 1990     (when VTC received virus code)
              where.: North Germany
Classification......: system virus (bootblock), resident
Length of Virus.....: 1. length on storage medium: 1024 byte
                      2. length in RAM           : 1024 byte
--------------------- Preconditions ----------------------------------
Operating System(s).: AMIGA-DOS
Version/Release.....: 1.2/33.166, 1.2/33.180 and 1.3/34.20
Computer model(s)...: AMIGA 500, AMIGA 1000, AMIGA 2000A, AMIGA 2000B
                         (and only with those memory expansions of
                          $0C000000 type)
--------------------- Attributes -------------------------------------
Easy Identification.: typical text: ---
Type of infection...: self-identification method: ---
                      system infection: RAM resident, reset resident,
                                        bootblock
Infection Trigger...: reset (CONTROL+Left-AMIGA+Right-AMIGA)
                      operation: any disk access
Storage media affected: only floppy disks (3.5" and 5.25")
Interrupts hooked...: vertical blank interrupt
Damage..............: permanent damage: overwriting bootblock; open
                         files may be destroyed when screen and key-
                         board are shut off and the user has to re-
                         start the computer using CONTROL+LEFT-AMIGA
                         +RIGHT-AMIGA keys; same functions as in
                         original BYTE BANDIT virus, only text was
                         stripped from bootblock and has been re-
                         placed by the text "dos.library"
                      transient damage: screen buffer manipulation:
                         screen becomes dark, keyboard seems to mal-
                         function; transient damage may be repaired
                         by pressing special key combination:
                         LEFT-ALT+LEFT-AMIGA (new AMIGAS: COMMODORE
                         key)+SPACE+RIGHT-AMIGA+RIGHT ALT, but the
                         virus is still active
Damage Trigger......: permanent damage: reset
                         operation: any disk access
                      transient damage: under following condition:
                         2 resets AND 6 infections AND execution of
                         BYTE BANDIT's own interrupt routine 5208 
                         times (about 7 minutes)
Particularities.....: uses StartIOVector; other resident programs 
                         using system resident list (KickTagPointer,
                         KickMemPointer) are shutdown;
                      copy counter: 19th word
Similarities........: clone of BYTE BANDIT with replacement of ori-
                         ginal virus text by string 'dos.library'
--------------------- Agents -----------------------------------------
Countermeasures.....: Names of tested products of Category 1-6:
                      Category 1: .2 Monitoring System Vectors:
                                     CHECKVECTORS 2.3
                                  .3 Monitoring System Areas:
                                     CHECKVECTORS 2.3, GUARDIAN 1.2,
                                     VIRUS-DETEKTOR 1.1
                      Category 2: Alteration Detection: ---
                      Category 3: Eradication: CHECKVECTORS 2.3,
                                               VIRUS-DETEKTOR 1.1
                      Category 4: Vaccine: ---
                      Category 5: Hardware Methods: ---
                      Category 6: Cryptographic Methods: ---
Countermeasures successful: CHECKVECTORS 2.3, GUARDIAN 1.2,
                            VIRUS-DETEKTOR 1.1
Standard means......: CHECKVECTORS 2.3
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Alfred Manthey Rojas
Documentation by....: Alfred Manthey Rojas
Date................: 13th JANUARY 1991
Information Source..: ---

.