Name         : Joshua 2

     Aliases      : Switch-Off

     Type/Size    : Boot/1024

     Clones       : No Clones 

     Symptoms     : A Sprite will be moved over the screen.

     Discovered   : 03-04

     Way to infect: Boot infection

     Rating       : Less Dangerous

     Kickstarts   : 1.2/1.3

     Damage       : Overwrites boot.

     Removal      : Install boot.

     Comments     : If you are booting with a Joshua 1-Virus infected
                    disk the virus allocates some chip-memory and
                    copies itself into this mem.  After that the virus
                    changes the COLD-Vector to stay resident in memory.
                    To infect other disks the virus patches the
                    BeginIO()-Vector from the trackdisk.device (So NO
                    danger for HD-User!). Additionally the virus patches
                    the Vec5-Interrupt -> $94(a6) which moves after a 
                    delay a sprite over the screen. The Sprite looks
                    like this:
                                   ___
                                 |   |
                                 | J |
                                 | O |
                                 | S |
                                 | H |
                                 | U |
                                 | A |
                                 |___|

                    The whole virus is crypted depending of $DFF006.



     SHI - A.D 05-94

[Go back]