Emil 1A Virus (July 30, 1989)
Entry...............: Emil 1A Virus  
Alias(es)...........: "Virus 1A"
Virus Strain........: ---
Virus detected when.: 1987? 
              where.: FR Germany
Classification......: System (Boot Sector) Virus
Length of Virus.....: 512 Byte
--------------------- Preconditions ------------------------------------
Operating System(s).: Atari-TOS
Version/Release.....: 1.0, 1.2 (1.4 not tested)
Computer model(s)...: All types of the Atari ST Series
--------------------- Attributes ---------------------------------------
Easy Identification.: Boot sector will not be infected, if first word 
                      is $6038.
Type of infection...: Infects the boot sector of the disk, if it is
                      regarded as not infected.
Infection Trigger...: Each time a floppy disk is changed, the new 
                      disk will be infected.
Storage media affected: Floppy disks.
Interrupts hooked...: No interrupts used; diskvector hdv_bpb changed.
Damage..............: Infects the boot sector of the disk, if it is 
                      regarded to be non-infected.
                      If the memory resident virus finds a fitting 
                      key on a boot sector (first longword = $60381092),
                      then that sector is loaded and executed, regard-
                      less of the checksum. (Normally, the checksum
                      should be $1234 to indicate that this boot sector
                      is executable).
Damage Trigger......: Keyword ($60381092) in other Boot sectors. 
Particularities.....: ---
Similarities........: See Emil 2A Virus.
--------------------- Agents -------------------------------------------
Countermeasures.....: Programs that calculate the checksum and 
                      change it, if it is $1234; then, the sector  
                      is regarded as not executable. The suspicious 
                      (dangerous) second part of the virus might 
                      not be recognized because it does not need
                      to have the proper checksum (see: Damage).
Countermeasures successful: --- 
Standard means......: Write protect the disk.
                      Write a well-known program to the boot sector;
                      'manually' change the checksum to a value other 
                      than $1234 .
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Thomas Piehl/ Michael Nagel
Documentation by....: Bert K|hler
Translated by.......: Bert K|hler/Paul Drake (Racal-Milgo/TEMEX)/
Date................: July 30, 1989
Information Source..: ---

.