Amilia Virus (25-Jan-1992)
Entry...............: Amilia Virus
Alias(es)...........: ---
Virus Strain........: Murphy Virus Strain
Virus detected when.: January 1992
              where.: 
Classification......: Program (appending) virus, resident
Length of Virus.....: 1,164 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM - PC, XT, AT, upward and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: Infected files will contain the string
                         "AmiLia I Virii  -  [NukE] i99i   
                          By Rock Steady/NukE"
Type of infection...: All *.COM and *.EXE files that are executed or 
                         opened will be infected if the files are
                         bigger than 1,614 bytes. COM files must also
                         be smaller than 64,000 bytes.
Infection Trigger...: Any of the following operations on any *.COM or
                         *.EXE file:Load/Execute, Open, Extended Open.
Infection targets:..: All *.COM files with 1614<=length<=64000 bytes;
                      All *.EXE files with 1614<=length and old header.
Interrupts hooked...: INT 1C, INT 24
Interrupts used.....: INT 13, INT 21, INT 40, INT 41
Damage..............: 1) On sundays, when executing or opening an *.EXE 
                         file, the following message is displayed:
                             "AmiLiA I Virii - [NukE]
                              Released Dec91 Montreal
                              (C) NukE Development Software Inc"
                         Thereafter, the program terminates.
                      2) Upon each INT 21 call, the virus also checks 
                         system tick count for being above equivalent
                         of about 16 hours; if this amount of on-time
                         is reached, a green smiley face on black back-
                         ground moves diagonally around the screen 
                         bouncing at edges and characters.
Damage Trigger......: 1) For the message: day of the week = Sunday;
                      2) For the smiley:  16 hours of power on time. 
Similarities........: ---
Particularities.....: This virus carefully looks for the correct INT 13
                         entry to avoid being trapped by a guardian.
--------------------- Agents -----------------------------------------
Countermeasures.....: 
- ditto - successful:
             Removal: Not always possible: a 'NE' type EXE will not 
                         work anymore. 
Standard means......:
--------------------- Acknowledgement --------------------------------
Location............: Micro-BIT Virus Center, Univ Karlsruhe, Germany
Classification by...: Christoph Fischer
Documentation by....: Christoph Fischer
Date................: January 25, 1992

.