"Gauweiler" Virus (31-January-1991)
Entry...............: "Gauweiler" Virus  
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: November 1990 (?origin) 
              where.: Kassel, FRG   (?)
                      (when/from where VTC received the sirus code)
Classification......: Bootsector virus
Length of Virus.....: 510 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: Atari-TOS
Version/Release.....: 1.0, 1.2 ,1.4
Computer model(s)...: All types of the Atari ST series
--------------------- Attributes -------------------------------------
Identification......: At the end of the boot sector, following text 
                         "AIDS" and "Gauweilers Rache V 3.0 4.7.88"; 
                         at the begin of bootsector:  $52F6498A (hex).
                      Remark: Dr. Gauweiler is a Bavarian politician
                         well known for his resentments against people
                         seeking asylum in Bavaria.
Type of infection...: Infects bootsector of the disk A, if it is 
                         regarded to be uninfected,  or if  an old 
                         version of this virus is on bootsector (V2.0).
Infection Trigger...: Check if bootsector is executable.
Media affected......: Infection of disk in drive A.
Interrupts hooked...: BIOS-trap used and changed by this virus.
Damage..............: Infects the bootsector of the disk, if it is 
                         regarded to be uninfected; clears first 
                         9 sectors of track 0 with the FAT.
Damage Trigger......: If counter at start of virus + 6 modulo 32=0;
                         value depends on number of infections.
Particularities.....: ---
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures.....: Programs that calculate bootsector's checksum 
                         and modify it, if = $1234. Then, the sector  
                         is regarded as not executable. The suspected  
                         more dangerous second part of the virus might 
                         not be recognized because it does not need
                         to have the correct checksum.
Countermeasures successful: ---
Standard means......: Write-protect the disk; write an easily 
                         identifiable bootsector; "manually" change 
                         the checksum to a value other than $1234.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Ralf Stegen
Documentation by....: Ralf Stegen 
Date................: 31-January-1991
Information Source..: ---

.