Amiga Virus Encyclopedia
Kickstart 1.x: probably not working based on very high DOS Jmps.
Kickstart 2.0: working
Kickstart 3.0: working
Kickstart 3.1: working
MC68040 : working
Installer: clx_doom.exe (406012 bytes packed Stc 4.10.2)
New created files:
-sys:c/assign (3220 bytes unpacked)
This is the original 37.4 assign command (25.5.91)
with the linked virus. The hunklength are
manipulated, so don`t wonder about the same lenght
as the original.
-sys:c/copy (5496 bytes unpacked)
This is the original 38.1 copy command (20.05.92)
with the linked virus.
-sys:libs/diskfont.library (15820 bytes unpacked)
This is the original library V39.3 (14.07.92) with
the linked virus.
The original Diskfont.library is 15340 bytes long. As a
result the virus is 480 bytes long.
This file is spreaded as AMIGA DOOM by Complex. But it not
even creates some output except from the virus.
______________ /\_________ _______ /\_
/ ______ / \/ \____ \|-/ _____\/__/
/ |_/ |/ / ___/|/ _|_/ \_
\______\____\ /\/\__\___|\___¯\____\__/\ /
Coded by Gengis / Complex!
The main programm is extremly lame coded. A DMS file can be
found in the file, whith some Mapus banners hanging around
and some IFF sound samples. At the beginning, all texts and
some other parts will be decoded using a lame cryptloop.
Then the files will be saved and some filecomments will be
set (set "RESTICTED" to bbs:user.data & to bbs:user.key).
The DMS file was uploaded to a quite known BBS on 26.05.94
Atleast this banner can be found in the header. Another
file is in the maincode, which is an intro. In this intro
you can read some texts from Melön Dezign.
The virus checks for higher processors and read the VBR and
installs a new interrupt in the $74 vector in the vectorpage
This is new. Nearly all other viruses only patch the vector-
This new interrupt increases a variable until it has reached
30000. As long as this value is not in the variable, it will
be tried to manipulate the $dff030 register. The $dff030
will be only changed, if a special string, which adress will
be calculated using the SerDat register ($dff018) and an
internal counter, will be found:
I think that it is something like hacking programm or a
special programm to manipulate the datatransfer from the
No other texts were found in the virus.
Detection in files tested 16.07.1994
Detection in memory and removal
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III with Xvs.library installed
Test by Markus Schmall tested 17.07.1994