Mouse (Inverter) Virus (Nov.11 1989)
Entry...............: Mouse (Inverter) Virus
Alias(es)...........: Ghost 
Virus Strain........: ---
Virus detected when.: ---
              where.: ---
Classification......: System (BootSector) Virus, Reset-resident, 
                      Overwriting
Length of Virus.....: 512 Byte
--------------------- Preconditions -----------------------------------
Operating System(s).: ATARI-TOS 
Version/Release.....: All Version of TOS
Computer model(s)...: All types of the Atari ST Series
--------------------- Attributes -------------------------------------
Easy Identification.: ---
Type of infection...: Self-Identification: The Virus tests adresse $140
                      for the first Virus instruction; virus installs
                      itself reset- and RAMresident if virus code does
                      not match.
Infection Trigger...: Each time a new diskette is inserted, the virus 
                      will infect the new diskette.
Storage media affected: The virus infect drive A,B!
Interrupts hooked...: No Interrupts used.
                      Resetvector for installation changed.
                      hdv_bpb changed to infect Bootsector of new Disk.
Damage..............: Permanent Damage: Overwriting Bootsectors.
                      Transient Damage: Inverting Mouse Up-Down Moving-
                                        direction.
Damage Trigger......: Damage Action after 10 infections. Always after     
                      5 new infections,the Mouse Movingdirection is 
                      again inverted.
Particularities.....: ---
Similarities........: ---
--------------------- Agents ------------------------------------------
Countermeasures.....: Programm that checks hdv_bpb-, Reset-vector if 
                      adresse is not lower $400(Exception vectors)
                      (Category 1.2).
                      Programs that calculate the checksum and change 
                      it, if it is $1234; the sector is then regarded
                      as not executable. Reboot the system with a
                      'clean' disk! ( Category 1.3 ).
Countermeasures successful: Poke instruction 'move.l #$D6,d3' to 
                      adresse $140 (this excludes Virus' installation).
Standard means......: Write-protect the disk. 
                      Write a well-known program to the boot sector;
                      'manually' change the checksum to a value other 
                      than $1234.
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Thomas Piehl  
Documentation by....: Thomas Piehl             
Date................: Nov. 11,1989
Information Source..: ---

.