= Computer Virus Catalog 1.2: DISASTER-MASTER V2 Virus (14-JAN-1991) = Entry...............: DISASTER-MASTER V2 Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: --- where.: Australia Classification......: link virus, resident Length of Virus.....: 1. length on storage medium: 1740 byte 2. length in RAM : ?? byte --------------------- Preconditions ---------------------------------- Operating System(s).: AMIGA-DOS Version/Release.....: 1.2/33.166, 1.2/33.180, 1.3/34.5 Computer model(s)...: AMIGA 500, AMIGA 1000, AMIGA 2000A, AMIGA 2000B --------------------- Attributes ------------------------------------- Easy Identification.: typical text: ?? identification by examining, using disk manager, the startup-sequence: if its first entry is "cls" and a file named "cls" exists in "c" or root directory with a length of 1740 byte $A0,$A0,$A0,$20,$9B,$41 (invisible in ASCII editors) Type of infection...: self-identification method: virus searches for the following entry in startup-sequence: "cls" AND a file "cls" in the c or root directory with length of 1740 byte; system infection: RAM resident, reset resident Infection Trigger...: using unprotected disk-like devices Storage media affected: all bootable and disk-like devices Interrupts hooked...: --- Damage..............: permanent damage: destroys directory structure transient damage: manipulation if window titles; following alert is displayed after destroying the structure of a bootable device: "Software Failure. Press Left Mouse Button to Continue Guru Meditation #00000002.06001989" and "Incoming special Message Your Amiga is in- fected by DISASTER-MASTER V2!!! probably the best virus created by mankind.... Left = continue Right = self-destruction" Damage Trigger......: permanent damage: (details to be analysed) transient damage: (details to be analysed) Particularities.....: KickTag pointer are misused, ColdCapture and CoolCapture vectors are cleared; DoIO vector is used (details to be analysed) Similarities........: (details to be analysed) --------------------- Agents ----------------------------------------- Countermeasures.....: Names of tested products of Category 1-6: Category 1: .2 Monitoring System Vectors: CHECKVECTORS 2.3, VT 1.94 .3 Monitoring System Areas: CHECKVECTORS 2.3, GUARDIAN 1.2, VIRUS-DETEKTOR 1.1, VT 1.94 Category 2: Alteration Detection: --- Category 3: Eradication: CHECKVECTORS 2.3, BGS9-PROTECTOR, VIRUS-DETEKTOR 1.1 Category 4: Vaccine: BGS9-PROTECTOR Category 5: Hardware Methods: --- Category 6: Cryptographic Methods: --- Countermeasures successful: CHECKVECTORS 2.3, VT 1.94 Standard means......: CHECKVECTORS 2.3 or VT 1.94 with deletion of "cls" file entry (see above) with a disk manager and correction of the startup-sequence --------------------- Acknowledgement -------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Alfred Manthey Rojas, Brian Logan Documentation by....: Alfred Manthey Rojas Date................: 10-February-1991 Information Source..: Brian Logan, Australia ===================== End of DISASTER-MASTER V2 virus ================ [Go back]