"FRANKIE" Virus (14-June-1990)
Entry...............: "FRANKIE" Virus  
Alias(es)...........: ---
Virus Strain........: "Aladin Emulator Viruses"                                
Virus detected when.: December '87                 
              where.: Hamburg, FRG
                      The virus was detected on a disk containing a 
                      document transfer utility for Aladin which was 
                      deliberately distributed by the Aladin producer 
                      "Proficomp" to protect their Aladin hardware
                      and software by destroying illegal copies.
           appeared.: France: January 1989
Classification......: Program Virus
Length of Virus.....: Varying from 3312 to 3822 Bytes in storage
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS             
Version/Release.....: Version 2.0 and higher                    
Computer model(s)...: Infection: all Apple MacIntosh series computers 
                         and Aladin (MacIntosh Emulator on Atari)); 
                         Spectre (Atari) and AMAX (AMIGA) emulators 
                         not infected, others not tested;
                         all ROM versions
                      Damage: will only occur on ATARI ST computers 
                         running illegal emulators other than the
                         original ALADIN (Board equipped with ROMs 
                         and a PAL chip); on AMAX (AMIGA) and SPECTRE
                         (Atari) emulators, Frankie is inactive. 
--------------------- Attributes ------------------------------------
Easy Identification.: ---                                             
Type of infection...: - extending affected programs by virus size;
                      - modifying affected program's jump table;      
                      - patching operating system calls in RAM;    
                      - upon  each launch, the programs "last 
                           modified" date entry is updated.   
Infection Trigger...: - program files are infected when copied (when 
                           an infected "Finder" is running);
                      - program files are infected when launched
                           (when an infected "Finder" is running);   
                      - a running "Finder" is infected when it 
                           launches an infected program.
Storage media affected: All type of media which is not write-protected
Interrupts hooked...: System traps OpenRF and SetFileInfo
Damage..............: The menu bar is replaced with a 'bomb' icon and 
                         the message "Frankie says:  no more piracy";
                         then, the system crashes.
Damage Trigger......: Value of infection counter, random time period 
                         (taken from VBL).
Particularities.....: Spectre (MacIntosh emulator) will not be in-
                        fected as a bug in Spectre's bus error 
                        handler deceives Aladin into thinking that 
                        it is not running on an Atari.  
Similarities........: ---
--------------------- Agents ------------------------------------------
Countermeasures.....: Names of tested products of Category 1-5:
                      Category 1: ---
                      Category 2: Viruskiller (VTC)
                      Category 3: Viruskiller, FrankieKiller (VTC)
                      Category 4: --- 
                      Category 5: write protect media
                      Category 6: ---
                      Moreover, many Macintosh antivirus programs
                      detect and eradicate Frankie.
Countermeasures successful: Applying Viruskiller application
Standard means......: - Check file size, file modification date;
                      - open file with ResEdit and check sequence of 
                           "CODE" resource entries; if the upper left 
                           icon has a higher resource number, be 
                           alert;
                      - open "CODE 0" with ResEdit and check byte $15; 
                           if it equals the highest available resource 
                           number, be warned.
                      - Use the INIT "Vaccine"
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Christian Markus, VTC
Documentation by....: Christian Markus/Zbigniew Fiedorowicz
Date................: 14-June-90
Information Source..: Zbigniew Fiedorowicz, Ohio (USA)

.