(c)  Copyright 1989 Commodore-Amiga, Inc.   All rights reserved.
The information contained herein is subject to change without notice, and 
is provided "as is" without warranty of any kind, either expressed or implied.  
The entire risk as to the use of this information is assumed by the user.


                        THE AMIGA VIRUS
                          Bill Koester



Definition
----------

   The Amiga virus is simply a modification of the boot block of an existing
DOS boot disk. Any disk that can be used to boot the Amiga (ie workbench)
has a reserved area called the boot block. On an Amiga floppy the bootblock
consists of the first two sectors on the disk. Each sector is 512 bytes long
so the boot block contains 1024 bytes. When KickStart is bringing up the
system the disk in drive 0 is checked to see if it is a valid DOS boot disk.
If it is, the first two sectors on the disk are loaded into memory and
executed. The boot block normally contains a small bit of code that loads
and initializes the DOS. If not for this boot code you would never see the
initial CLI. The normal boot code is very small and does nothing but call
the DOS initialization. Therefore, on a normal DOS boot disk there is plenty
of room left.


   The virus is a replacement for the normal DOS boot code. In addition to
performing the normal DOS startup the virus contains code for displaying
the virus message and infecting other disks. Once the machine is booted from
an infected disk the virus remains in memory even after a warm start since
the warm start routine is "infected" too.  Instead of going through the normal
startup, the virus checks the boot disk in df0: for itself. If the virus in 
memory sees that the boot block is not infected it copies itself onto the 
boot block over-writing any code that was there before. It is in this manner 
that the virus propagates from one disk to another. After a certain number of 
disks have been infected the virus will print a message telling you that
"something wonderful" has happened.


Dangers
-------

   When the virus infects a disk the existing boot block is over-written.
Since some commercial software packages, especially games, store special
information in the boot block the virus could damage these disks. When the
boot block is written with the virus, any special information is lost
forever. 


Mechanics
---------

   Here is a more detailed description of how the virus works - please use 
this information for learning and understanding only.  Do not use it to 
create more virus problems in the Amiga community.


Infiltration

This is the first stage of viral infection. The machine is brought up normally
by reading the boot block into memory. When control is transferred to the boot
block code, the virus code immediately copies the entire boot block to $7EC00.
It then JSR's to the copied code to wedge into the CoolCapture vector.  Once
wedged in, control returns to the loaded boot block which performs the normal 
DOS initialization. Control is then returned to the system.

Hiding Out

At this point the system CoolCapture vector has been replaced and points to 
code within the virus. When control is routed through the CoolCapture vector 
the virus first checks for the left mouse button, if it is down the virus 
clears the CoolCapture wedge and returns to the system. If the left mouse 
button is not pressed the virus replaces the DoIO code with its own version 
of DoIO and returns to the system.

Spreading

The code so far has been concerned only with making sure that at any given 
time the DoIO vector points to virus code. This is where the real action takes
place. On every call to DoIO the virus checks the io_Length field of the IOB 
if this length is equal to 1024 bytes then it could possibly be a request to 
read the boot block. If the io_Data field and A4 point to the same address
then we know we are in the strap code and this is a boot block read request. 
If this is not a boot block read the normal DoIO vector is executed as if the 
virus was not installed. 

If we are reading the boot block we JSR to the old DoIO code to read the boot 
block and then control returns to us. After reading, the checksum for the 
virus boot block is compared to the checksum for the block just read in. 
If they are equal this disk is already infected and the code returns.  If 
they are not equal a counter is incremented and the copy of the virus at 
$7EC00 is written to the boot block on the disk. If the counter ANDed with 
$F is equal to 0, then a rastport and bitmap are constructed and the message
is displayed.


The Message

            < Something wonderful has happened >
                 < Your AMIGA is alive!!! >
                    < and even better >
         < Some of your disks are infected by a VIRUS >
         < Another masterpiece of the Mega-Mighty SCA >


Prevention
----------

How do you protect yourself from the virus?

      1) Never warm start the machine, always power down first.
         This works but is not very practical.

      2) Always hold down the left mouse button when rebooting.
         This also works, but only with the current SCA virus since 
         it checks for mouse presses.  Future viruses may not.

      3) Obtain a copy of VCheck1.2 and check all disks before use.
         VCheck1.2 is posted on Usnet and BIX.

      4) If you can't get a copy of VCheck, then use a sector editor
         like SectORama (Fish Disk #108, #102) to check the boot block
         for virus text.

Treatment
---------

The virus can be removed from an infected disk by using the DOS Install command
which will put standard boot code in the boot block.  Be careful though, the
Install command will over-write any code that was there.  You should only use
Install on a DOS boot disk. Applications, especially games, may have a custom
boot block which will be destroyed by the Install command.

If you have an infected game disk, then chances are the boot block is already
corrupted so you have nothing to lose by trying the Install command.  You could s
also try returning the disk to the publisher for a new copy if they have a
policy of replacing faulty disks.  If you do this, clearly mark the disk with
the word virus so no one else is infected.

