DARTH VADER (V1.1) Virus (31-July-1993)
Entry...............: Darth Vader (V1.1) Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: ---
              where.: ---
Classification......: Memory resident File virus 
Length of Virus.....: 1.Length on storage medium: 784 bytes
                      2.Length in RAM           : 627 bytes.
--------------------- Preconditions ------------------------------------
Operating System(s).: AMIGA-OS
Version/Release.....: 1.2/all, 1.3/all, 2.0/all, 3.0/all
Computer model(s)...: All Amiga models
--------------------- Attributes ---------------------------------------
Easy Identification.: Virus can be found in root directory and at
                         beginning of "startup-sequence"; it is named 
                         <AlternateSpace> ($A0). Typical text in file: 
                         "VIRUS(V1.1) BY DARTH VADER".
Type of infection...: RAM resident, reset resident
Infection Trigger...: Booting (startup-sequence), starting an infected
                         program, OldOpenLib call.
Storage media affected: All
Interrupts hooked...: Virus changes the following vectors:
                         CoolCapture (program start), OldOpenLib (RESET)
Damage..............: Transient: text output
                      Permanent: corrupted startup-sequence written 
                                 to disk.
Damage Trigger......: OldOpenLib call
Particularities.....: Starting with 5th RESET, virus writes on every 
                         OldOpenLib call the following text:
                         "VIRUS(V1.1) BY DARTH VADER" to STD-Output and 
                         waits for left mousebutton to be pressed.
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: VirusZ 3.06, VT 2.54, VirusChecker 6.28
Countermeasures successful: VirusZ 3.06, VT 2.54
Standard means......: Delete file $A0 from root Directory, delete 
                         filename $A0 from startup-sequence, turn 
                         computer off and on again. Or: use VT 2.54.
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Jens Vogler
Documentation by....: Jens Vogler
Date................: 31-July-1993
Information Source..: Reverse-engineering of virus code.

.