Emil 2A Virus (July 30, 1989)
Entry...............: Emil 2A Virus  
Alias(es)...........: "Virus 2A" = mad Virus
Virus Strain........: ---
Virus detected when.: 1987?
              where.: FR Germany
Classification......: System (Boot Sector) Virus
Length of Virus.....: 512 Byte
--------------------- Preconditions ------------------------------------
Operating System(s).: ATARI-TOS
Version/Release.....: 1.0, 1.2 (TOS 1.4 not tested)
Computer model(s)...: All ATARI ST Computer models
--------------------- Attributes ---------------------------------------
Easy Identification.. First byte in infected boot sector is $60.
Type of infection.... Infects the boot sector of a disk, if it is 
                      regarded as not yet infected (value other than
                      $60 in first byte) and increments a variable.
Infection Trigger...: Every access to non-infected floppy disk.
Storage media affected: Floppy disks.
Interrupts hooked...: No Interrupts used;
                      hdv_rw vector changed to infect new disks.
Damage............... Permanent Damage: overwrites Boot sectors.
                      Transient damage: After each 5th infection, the 
                      screen is randomly shifted (upside down) or
                      inverted, together with a beep.
Damage Trigger......: Random.
Particularities.....: Evidently, this is a "Demo Virus"; but it may 
                      easily be changed to a dangerous one with only 
                      moderate programming experiences.
Similarities........: See Emil 1A Virus.
--------------------- Agents -------------------------------------------
Countermeasures.....: Programs that calculate the checksum and change 
                      it, if it is $1234; then, the sector is regarded 
                      as not executable.
Countermeasures successful: --- 
Standard means......: Write protect the disk.
                      Write a well-known program to the boot sector;
                      'manually' change the checksum to a value other 
                      than $1234.
                      Reboot the system with a 'clean' disk.
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Ralf Stegen
Documentation by....: Ralf Stegen
Translation by......: Bert K|hler
Date................: July 30, 1989
Information Source..: ---

.