"Maulwurf" (Mole) Virus (5-June-1990)
Entry...............: "Maulwurf" (=Mole) Virus
Alias(es)...........: Maulwurf I SSG (=Subversive Software Group) Virus
Virus Strain........: ---
Virus detected when.: 14 May 1989
              where.: Utrecht (Netherlands)
Classification......: System (BootSector) Virus, Reset-resident, 
                      Overwriting
Length of Virus.....: 512 Byte
--------------------- Preconditions -----------------------------------
Operating System(s).: ATARI-TOS 
Version/Release.....: Only TOS Version 1.0
Computer model(s)...: Atari ST with TOS 1.0
--------------------- Attributes --------------------------------------
Easy Identification.: ---
Type of infection...: Self-Identification: The virus tests, if its 
                      whole code from boot sector is behind screen 
                      memory; if not, virus installs itself reset-
                      resident and  patches system initialisation
                      after reset.
Infection Trigger...: Each time a new diskette is inserted, the virus 
                      will infect the new diskette.
Storage media affected: The virus infects only drive A,B
Interrupts hooked...: -VBL Interrupt: 1.to check if hdv_bpb is changed 
                                        back to old address; 
                                      2.to test if time is right to 
                                        deadlock the system.
                      -Resetvector to patch system initialisation.
                      -hdv_bpb changed to infect boot sector of new disk.
Damage..............: Permanent Damage: Overwriting boot sectors.
                      Transient Damage: Whole screen filled with message
                      'Maulwurf I - SSG (Subversive Software Group)' 
                      and deadlock system also after reset if time is 
                      over.
Damage Trigger......: after 7 minutes + number of infections * 5 minutes     
                      The counter is located at start of virus+$1FC.
Particularities.....: ---
Similarities........: ---
--------------------- Agents ------------------------------------------
Countermeasures.....: Programs that checks hdv_bpb-, Reset-vector if 
                      adress points after screen memory (Category 1.2).
                      Programs that calculate the checksum and change 
                      it, if it is $1234; the sector is then regarded
                      as not executable. Reboot the system with a
                      'clean' disk! (Category 1.3).
Countermeasures successful:---
Standard means......: Write-protect the disk. 
                      Write a well-known program to the boot sector;
                      'manually' change the checksum to a value other 
                      than $1234.
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Thomas Piehl  
Documentation by....: Thomas Piehl
Information Source..: from George R. Woodside
Date................: 5-June-1990

.