Amiga Virus Encyclopedia
Length: 1024 bytes
Patched vectors: -Coolcapture (always patched to $7f296)
-SumKickData (always patched to $7f32a)
-DoIO (always patched to $7f2da)
The original value of the DoIO vector
will be stored at $7fa02.
The original bootblock will be stored at sector 1738 and
will be loaded from the virus and the virus jumps directly
in the original bootcode. The virus contains a write
routine, which writes the text "ELENI" (via DOIO). The
writeroutine uses not the dos.library, pure DOIO action !
At the start of the virus, the viruscode will be copied
to $7f144 (without allocating the memory before). On
system with low memory, it can happen very often, that the
system crashes. The viruses uses the adress $60000 as a
flag for the textwriteroutine. The area $70000 and higher
will be used from the virus without allocating the memory.
The text "*ELENI*" is visible at the end of the file. In
the middle you can read something about "Version 1.6".
If the virus has read several times from sector 1738 and
a counter (hardware) reached the value 1 , it will
overtake the control of the drive(s) and manipulates CIA
and the drivecontrol register.
If the counter reached the value 4, the writeroutine for
the "*ELENI*" string will be started. The counter is
located at $dc002d. I don`t know, what is this for a
register and I could not find out, if it is always init-
ialized with the same value. On my AMIGA it contained the
If a DoIO read access was caught, the infection routine
will be started. If a DoIO write access was caught, the
writeroutine will be started. In the NewDoIO routine, the
virus handle with the CIA-A registers (powersupply ticks
and interrupt control).
Due to no checkroutine for Trdevice, the virus can
destroy (in my opinion) the RDB.
The infection routine reads the original bootblock to
$70000, tests it and at success, the virus writes the
original bootblock to the sector 1738 and copies itself
to sector 0. The bootblock at sector 1738 will be saved
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III, and also Xvs.library must be installed
Detection in BB & memory tested 18.05.1994
Test by Markus Schmall...
Ascii of Eleni virus: