------------------------
     Amiga Virus Encyclopedia
     A.I.S.F. Virus
     ------------------------
    

     Name         : A.I.S.F.

     Aliases      : A.I.S.F. Interlamer

     Clones       : No Clones

     Type         : Trojan
     
     Size         : 8708 bytes

     Symptoms     : Shows an DisplayAlert

     Discovered   : 17-08-93

     Way to infect: No infection

     Rating       : Dangerous

     Kickstarts   : 1.2/1.3/2.0

     Damage       : No Damage

     Manifestation: -

     Removal      : Delete file immediately.

     Info         : This virus will be probably spreaded as a faked VirusChecker
                    update.The file works with all kind of Kickstarts and  memory-
                    configurations and has no problems with faster processors.

                    This file opens a window ith the following name:
                    'VIRUS-CHECKER V6.72'
                    'by A.I.S.F. !!!'

                    The window has no funtion. It`s only a trick to irritate the users.

                    The $6c Vector in the Zeropage will be patched. Following routine
                    will be installed in the vector:
                    1.Decrease a counter by 1
                    2.Compare if it $50000
                    3.If not,do nothing
                    4.If $50000 is reached,then display the following alert,which will
                    be decrypted first:

                    `!! CRIME DO NOT PAY !!!`
                    `WHY ARE YOU SWAPPING ILLEGAL SOFT ?`
                    `BECAUSE YOU ARE A CRIMINAL !!!!`
                    `AND BE SURE:`
                    `WE (A.I.S.F.) WILL GET YOU !`
                    `(A)NTI`
                    `(I)ILLEGAL`
                    `(S)WAPPING`
                    `(F)OUNDATION`
                    `-PRESS MOUSE TO CONTINUE-`

                    If you then press a mousebutton,then the destroyroutine will be
                    started. Your drivemotorhead steps around on the disk.

                    I am only wondering, why the value $50000 was chosen.If you count
                    only the VBI interrupt then the virus would start its work  after
                    nearly 2 hours.

                    At the end of the file (which is not crunched),you can see a non-
                    crypted text,which says several times:
                    ' THE A.I.S.F. INTERLAMER-VIRUS  '

    Antivirus     : Kickstart 1.2 & 1.3 VT-Schutz
                    Kickstart 2.0 and higher VirusZ III, with the new Xvs.library installed

    Test made by  : Markus Schmall 


    Screenshot of AISF file virus:
    

    

☣

Virus Help Team Denmark & Canada Copyright © All Rights Reserved

☣