c't-Virus (July 30, 1989)
Entry...............: c't Virus 
Alias(es)...........: ---  
Virus Strain........: ---
Virus detected when.: ---
              where.: ---
Classification......: System (=BootSector) Virus, Reset-resident.
Length of Virus.....: 512 Byte
--------------------- Preconditions ------------------------------------
Operating System(s).: ATARI-TOS
Version/Release.....: 1.0 (06.02.86), 1.2 (TOS 1.4 not tested)
Computer model(s)...: All types of the Atari ST Series
--------------------- Attributes ---------------------------------------
Identification......: ---
Type of infection...: The virus tests two longwords near the top of the
                      available memory at locations (memtop)-$200 and
                      (memtop)-$200+$A.
                      The first longword is checked for $12123456, the
                      second one for $07A31CDF. If one of these doesnot
                      match, the virus is installed.
                      The virus is reset-resident.
                      1st: Virus is copied to a new location in memory;
                      2nd: Virus's age is increased by 1.
Infection Trigger...: Each time a diskette is changed, the new one
                      will be infected.
Storage media affected: Infects only diskettes. Damages Hard disks.
Interrupts hooked...: No interupts used.hdv_bpb and hdv_mediach vectors 
                      are changed for installation in the system.
Damage..............: Transient/Permanent damage:
                      A damage can occur only if a harddisk is connected 
                      to the system. Because of an error in the virus, 
                      the partition information will be destroyed, if 
                      the virus tries to write to the harddisk.
                      Otherwise, the following message is displayed on 
                      the screen after every 20th infection:
                      "ARRRGGGHHH Diskvirus hat wieder zugeschlagen" 
Damage Trigger......: Value of infection counter: every 20th infection.
Particularities.....: ---
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: Programs that calculate the checksum and change 
                      it, if it is $1234; the sector is then regarded as 
                      not executable. (Category 1.3)
Countermeasures successful: ---
Standard means......: Write-protect the disk. Write a well-known program
                      to the boot sector; 'manually' change the check-
                      sum to a value other than $1234 .
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: 
Documentation by....: Michael Gaudlitz          
Translated by.......: Bert K|hler  
Date................: July 30, 1989
Information Source..: c't (Computer Magazine)                              

.