--------------------------    
Amiga Virus Encyclopedia    
Ultrafox Virus (SCA Clone)
--------------------------

    
======== Computer Virus Catalog 2.0: SCA.Ultrafox  (30. X. 1993) ========
Entry...............: SCA.Ultrafox
Alias(es)...........: UF-Virus
Virus Strain........: SCA
      detected when.: unknown
              where.: unknown
Classification......: system virus (bootblock), resident
Length of Virus.....: 1. length on storage medium: 1024 byte
                      2. length in RAM           : 1024 byte
--------------------- Preconditions -------------------------------------
Operating System(s).: AMIGA-OS
Version/Release.....: 1.2/all, 1.3/all, 2.0/all, 3.0/all
Computer model(s)...: all AMIGAs
--------------------- Attributes ----------------------------------------
Easy identification.: Copperlist at the end of the BootBlock:
                      dc.l $E00006,$E2EA00
                      dc.l $9601FFA0,$1800004
                      dc.l $9701FFA0,$1800006
                      dc.l $9801FFA0,$1800008
                      dc.l $9901FFA0,$180000A
                      dc.l $9A01FFA0,$180000C
                      dc.l $A601FFA0,$1800002
                      dc.l $A901FFA0,$1800003
                      dc.l $FFFFFFFE,0
Type of Infection...: Self-identification method: compares bootblock
                      checksum with precalculated virus checksum
                      System infection: reset resident (coolcapture),
                      bootblock, DoIO call patched
Infection Trigger...: reset, booting from infected disk
Storage Media affec.: floppy disks only
Systemcalls hooked..: --
Stealth.............:
Tunneling/Selfprot..:
Oligo/Polymorphism..:
Encoding Method.....:
Damage..............: Permanent damage: overwriting bootblock
                      Transient damage: screen buffer manipulation:
                      standard screen will be closed
                      and a virus owned screen will be
                      displayed with the text:
                      Greetings from ULTRAFOX of Aust.
Damage Trigger......: Permanent damage: reset
                      Transient damage: 15th infection
Particularities.....: This is not a typical (primitive) SCA clone. The
                      Author rewrites parts of the code and uses a
                      different display routine using a bitmap graphic.
Similarities........: see SCA.Original
--------------------- Agents --------------------------------------------
Countermeasures.....: Virus Workshop V3.0, VirusChecker V6.33,
                      VT 2.58, VirusZ 3.07
Standard means......: VT 2.58, Virus Workshop V3.0
--------------------- Acknowledgements ----------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Jens Vogler
Documentation by....: Jens Vogler
Date................: 30. X. 1993
Information Source..: virus disassembly
========================== End of SCA.Ultrafox ==========================

Antivirus...........: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                      Kickstart all others: VirusZ III v1.04B or higher, and also Xvs.library v33.47 or higher


Screenshot of Ultrafox Virus: