"ACA"-VIRUS (5-June-1990)
Entry............... "ACA" Virus
Alias............... ---
Strain.............. ---
Detected when....... October 1988
         where...... Utrecht (Netherlands)
Classification...... System (Bootsector) Virus, Reset-resident
Length of virus..... 512 Bytes
------------------------Preconditions----------------------------------
Operating System(s). Atari TOS
Version\Release..... All versions
Computer models..... All Atari ST,STE
-------------------------Attributes------------------------------------
Easy identification. If the bootsector is infected, the string "ACA"
                     can be found at bootsector position $04 and $4E.
                     In memory, the same string can be found at $630.
Type of infection...: Self-Identification: The Virus tests boot sector-
                      position 4 for String "AC"; if string does not 
                      match, virus infects boot sector.
                      Reset-resident at address $600 via magic long-
                      word ($12123456) and checksum ($1234).
Infection Trigger...: Reset
Storage media affected: The virus infects drive A,B!
Interrupts hooked...: No Interrupts used.
                      No system vectors changed
Damage..............: Permanent Damage: Only after reset overwriting 
                      boot sectors.
                      Transient Damage: Clearing first track
Damage Trigger......: Damage occurs after 10 infections. 
Particularities.....: ---
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures.....: Program that search for reset-resident programs, 
                      especialy lower system area ($800).
                      Programs that calculate the checksum and change 
                      it, if it is $1234; the sector is then regarded
                      as not executable. Reboot the system with a
                      'clean' disk! ( Category 1.3 ).
Countermeasures successful:---
Standard means......: Write-protect the disk. 
                      Write a well-known program to the boot sector;
                      'manually' change the checksum to a value other 
                      than $1234.
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Thomas Piehl  
Documentation by....: Thomas Piehl 
Information Source..: from George R. Woodside           
Date................: 5-June-1990

.