VIRUS HELP TEAM Amiga Antivirus Website www.vht-dk.dk
------------------------
Amiga Virus Encyclopedia
SCA Virus
------------------------
========= Computer Virus Catalog 1.2: SCA Virus (5-June-1990) =========
Entry...............: SCA Virus
Alias(es)...........: ---
Virus Strain........: SCA Virus
Virus detected when.: November 1987
where.: Elmshorn, FRG
Classification......: system virus (bootblock), resident
Length of Virus.....: 1. length on storage medium: 1024 byte
2. length in RAM : 1024 byte
--------------------- Preconditions -----------------------------------
Operating System(s).: AMIGA-DOS
Version/Release.....: 1.2/33.166, 1.2/33.180 and 1.3/34.20
Computer model(s)...: AMIGA 500, AMIGA 1000, AMIGA 2000A, AMIGA 2000B
--------------------- Attributes --------------------------------------
Easy Identification.: typical text: 'Something wonderful has happened
Your AMIGA is alive !!! and, even better...
Some of your disks are infected by a VIRUS !!!
Another masterpiece of The Mega-Mighty SCA !!'
virus feature: pressing left mouse/fire button of
port 1 during system reboot, causes the screen
to become green and the virus to shut down it-
self by clearing ColdCapture and CoolCapture
Vectors
Type of infection...: self-identification method: testing 3rd longword
for matching string 'CHW!'
system infection: RAM resident, reset resident,
bootblock
Infection Trigger...: reset (CONTROL + Left-AMIGA + RIGHT-AMIGA)
Storage media affected: only floppy disks (3.5" and 5.25")
Interrupts hooked...: ---
Damage..............: permanent damage: overwriting bootblock
transient damage: screen buffer manipulation:
screen becomes black, message (see above) is
shown by fading in and out peaces of it
Damage Trigger......: permanent damage: reset
transient damage: 15th infection
Particularities.....: a resident program using the CoolCaptureVector is
shut down, also when using the ColdCapture
Vector when the virus is shut down by its
'suicide' function
Similarities........: AEK virus
--------------------- Agents ------------------------------------------
Countermeasures.....: Names of tested products of Category 1-6:
Category 1: .2 Monitoring System Vectors:
'CHECKVECTORS 2.2'
.3 Monitoring System Areas:
'CHECKVECTORS 2.2','GUARDIAN 1.2',
'VIRUSX 4.0', 'VIRUSKILLER 2.0'
Category 2: Alteration Detection: --
Category 3: Eradication: 'CHECKVECTORS 2.2',
'VIRUSX 4.0', 'VIRUSKILLER 2.0'
Category 4: Vaccine: 'SCA-PROTECTOR 1.0',
'VIRUSKILLER 2.0'
Category 5: Hardware Methods: ---
Category 6: Cryptographic Methods: ---
Countermeasures successful: 'CHECKVECTORS 2.2', 'GUARDIAN 1.2',
'VIRUSKILLER 2.0', 'SCA-PROTECTOR 1.0',
'VIRUSX 4.0'; own suicide function
Standard means......: 'CHECKVECTORS 2.2'
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Oliver Meng
Documentation by....: Alfred Manthey Rojas
Date................: 5-June-1990
Information Source..: ---
===================== End of SCA Virus ================================
Virus Info : The SCA virus is the first computer virus created for the Amiga
and one of the first to gain public notoriety. It appeared in
November 1987. The SCA virus is a boot sector virus. It features
a line of text that appears at every 15th copy after a warm
reboot:
"SCA" is an acronym for the Swiss Cracking Association, a group
engaged in software protection removal, so the geographic origin
of the virus was Switzerland. The virus is probably authored by
an SCA member known as "CHRIS".
SCA will not harm disks per se, but spreads to any write-enabled
floppies inserted. If they use custom bootblocks (such as games)
they are rendered unusable. SCA also checksums as an original
filesystem (OFS) bootblock, hence destroying newer filesystems
if the user doesn't know the proper use of the "install" command
to remove SCA ( "install df0: FFS FORCE" to recover a 'fast
filesystem' floppy).
The "Mega-Mighty SCA" produced the first Amiga virus checker
which killed the SCA virus. This may well have been in response
to estimates that approximately 40% of all Amiga users had SCA
in their disk collection somewhere, due to rampant piracy and
floppy disk sharing.
Antivirus...........: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III v1.04B or higher, and also Xvs.library v33.47 or higher
Animation of the SCA Original Bootblock Virus:
Info : The 'SCA virus' is the first computer virus, created for the Commodore Amiga and one of the first
to gain public notoriety. It first appeared in November 1987.
Ascii of SCA virus:
Info : The 'SCA virus' is the first computer virus, created for the Commodore Amiga and one of the first
to gain public notoriety. It first appeared in November 1987.
Ascii of SCA virus:
