------------------------
Amiga Virus Encyclopedia
A.I.S.F. Virus
------------------------
A.I.S.F. Virus:
---------------
Length: 8708 Bytes
This virus will be probably spreaded as a faked VirusChecker
update.The file works with all kind of Kickstarts and memory-
configurations and has no problems with faster processors.
This file opens a window ith the following name:
'VIRUS-CHECKER V6.72'
'by A.I.S.F. !!!'
The window has no funtion.It`s only a trick to irritate the users.
The $6c Vector in the Zeropage will be patched. Following routine
will be installed in the vector:
1.Decrease a counter by 1
2.Compare if it $50000
3.If not,do nothing
4.If $50000 is reached,then display the following alert,which will
be decrypted first:
`!! CRIME DO NOT PAY !!!`
`WHY ARE YOU SWAPPING ILLEGAL SOFT ?`
`BECAUSE YOU ARE A CRIMINAL !!!!`
`AND BE SURE:`
`WE (A.I.S.F.) WILL GET YOU !`
`(A)NTI`
`(I)ILLEGAL`
`(S)WAPPING`
`(F)OUNDATION`
`-PRESS MOUSE TO CONTINUE-`
If you then press a mousebutton,then the destroyroutine will be
started.Your drivemotorhead steps around on the disk.
I am only wondering,why the value $50000 was chosen.If you count
only the VBI interrupt then the virus would start its work after
nearly 2 hours.
At the end of the file (which is not crunched),you can see a non-
crypted text,which says several times:
' THE A.I.S.F. INTERLAMER-VIRUS '
VirusWorkshop removes the useless and the patched $6c vector.
Thanks must go to Ingo Schmidt for sending me this virus.
Removal : Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III with Xvs.library installed
Test by Markus Schmall Detection tested on 11.09.1993.
Screenshot of AISF file virus: