VIRUS HELP TEAM Amiga Antivirus Website www.vht-dk.dk
------------------------
Amiga Virus Encyclopedia
A.I.S.F. Virus
------------------------
Name : A.I.S.F.
Aliases : A.I.S.F. Interlamer
Clones : No Clones
Type : Trojan
Size : 8708 bytes
Symptoms : Shows an DisplayAlert
Discovered : 17-08-93
Way to infect: No infection
Rating : Dangerous
Kickstarts : 1.2/1.3/2.0
Damage : No Damage
Manifestation: -
Removal : Delete file immediately.
Info : This virus will be probably spreaded as a faked VirusChecker
update.The file works with all kind of Kickstarts and memory-
configurations and has no problems with faster processors.
This file opens a window ith the following name:
'VIRUS-CHECKER V6.72'
'by A.I.S.F. !!!'
The window has no funtion. It`s only a trick to irritate the users.
The $6c Vector in the Zeropage will be patched. Following routine
will be installed in the vector:
1.Decrease a counter by 1
2.Compare if it $50000
3.If not,do nothing
4.If $50000 is reached,then display the following alert,which will
be decrypted first:
`!! CRIME DO NOT PAY !!!`
`WHY ARE YOU SWAPPING ILLEGAL SOFT ?`
`BECAUSE YOU ARE A CRIMINAL !!!!`
`AND BE SURE:`
`WE (A.I.S.F.) WILL GET YOU !`
`(A)NTI`
`(I)ILLEGAL`
`(S)WAPPING`
`(F)OUNDATION`
`-PRESS MOUSE TO CONTINUE-`
If you then press a mousebutton,then the destroyroutine will be
started. Your drivemotorhead steps around on the disk.
I am only wondering, why the value $50000 was chosen.If you count
only the VBI interrupt then the virus would start its work after
nearly 2 hours.
At the end of the file (which is not crunched),you can see a non-
crypted text,which says several times:
' THE A.I.S.F. INTERLAMER-VIRUS '
Antivirus : Kickstart 1.2 & 1.3 VT-Schutz
Kickstart 2.0 and higher VirusZ III, with the new Xvs.library installed
Test made by : Markus Schmall
Screenshot of AISF file virus: