History of Viruses on Atari TOS Computers
PART I
THE ULTIMATE VIRUS KILLER BOOK
4 - THE HISTORY OF VIRUSES ON ATARI TOS COMPUTERS
In the previous chapter we already lifted a tip of the huge veil
that covers the virus scene on various computer systems. However,
what with us being Atari owners, the next logical step down the
line is to our own system, the Atari TOS computer platform. What
has happened over the years, exactly, and which noteworthy stages
have there been in Atari viral development and the battle against
it?
4.1 THE EARLY DAYS
The documented history of viruses on Atari TOS computers
started, as could be concluded from an earlier chapter, late at
night (or, rather, early in the morning) on November 22nd 1987
with the discovery of the first ST virus. That's the documented
history, mind you, for it cannot be told exactly when that first
virus (known as the Signum-, BPL-or Key Virus) was written and
when it first 'hit the disks', as it were. It is fairly certain
that it started out in Europe, as virus records in the United
States, for example, seem only to have started in May 1988.
Around that time, George Woodside started programming his Public
Domain "VKiller" program there, which was to become the industry
standard non-commercial virus killer for a very long time.
On March 26th 1988, after a relatively long time of supposed
safety, the next virus was discovered: The MAD-or Fun Virus.
Luckily, this virus was quite harmless. As it later turned out,
it was actually a slightly modified version of a bootsector virus
that had appeared as a type-in-listing in a German magazine
called "Atari Spezial". In retrospect there had already been a
few other viruses around at the time, too, but these were not
discovered until later.
Probably the first time when ST viruses were spread on original
software was in May 1988, when the German company GfA
Systemtechnik accidentally supplied 10,000 infected copies of the
disk belonging to a GfA Basic Book (not the actual "GfA Basic"
program disk, though). They found this out relatively quickly,
but unfortunately 1,500 copies of the book - with infected disks
- had already been sold. GfA Systemtechnik was the first company
to seriously get into contact with the virus phenomenon on the
Atari ST. Back then, they started to check all disks more
carefully and supply people with a source listing of a simple
virus killer.
-----------------------------------------------------------------
Year: Virus quantity: Relative qty growth: Absolute qty growth:
-----------------------------------------------------------------
1987 3 n.a. n.a.
1988 15 400% 12
1989 33 120% 18
1990 48 45% 15
1991 62 29% 14
1992 72 16% 10
1993 78 8% 6
1994 106 35% 28
1995 112 6% 6
-----------------------------------------------------------------
Known virus quantities on the Atari computer platform
4.2 C'T VIRUSES
Probably with the aim of getting known in the Atari scene
quickly by means of some controversial coverage, the German
magazine "C'T" ("Computer & Technik") was the first to supply the
reader with fully documented ready-to-type-in listings of link-as
well as bootsector-viruses. It started off with an article called
"Die Viren kommen" ("The viruses are coming") by a guy called
Eckhard Krabel, in April 1987. This featured a source listing of
a link virus called Milzbrand (German for Anthrax). The source
was fully documented, so everybody with some reasonable system-
and programming-knowledge could adapt it and create their own
varieties of this link virus. Mr Krabel obviously thought that
the remark, "Only gangster types without scruples will type in
the following bit", written above the part of the source file
that comprised the destruction routine, would actually cause
people to refrain from doing so.
"C'T" magazine obviously did not think this was enough. Instead
of filling the next year's issues with apologies for their rather
blatant disregard of ethics and utter lack of common sense, they
published another article (July 1988): "Die Viren sind da" ("The
viruses are here"). This time, authors Thomas Koziel and Guido
Leister dissected a new bootsector virus they claimed to have
found on one of their disks. Of course, the source listing was
fully documented again, so principally everybody could make
endless variations. Rumours abounded at the time that three of
these variations had also actually been made, though it is now
thought this was all part of the 1988 German virus hype. The
rather terrible thing about the C'T Virus (the bootsector
variety) was that its reproduction routine contained a bug, also
allowing it to multiply to a hard disk instead of just to floppy
disks. Bootsector virus reproduction to hard disk almost
invariably results in data being lost there, and possibly
damaged.
4.3 THE VIRUS CONSTRUCTION SET
At the 1988 Düsseldorf Atari Fair, a friend of mine (the very
same Frank Lemmen of the virus killing days of old) ran into a
little booth where, apparently, people were involved in the sale
of a product called "Virus Construction Set - Part II". It was a
company called GFE R. Becker KG, which normally traded from a
little town called Bad Soden am Taunus in Germany.
Because he had a hunch I would be interested in this product, he
bought it - for 60 German marks, I recall - and sent it to me as
fast as he could. Before he was allowed to take it with him,
though, he had to promise the salesman that he would not mention
their company name to anyone. The purchase receipt was scribbled
on a standard white note pad sheet, carefully avoiding mention of
the company's name, too.
I had already heard of its prequel, the "Virus Construction Kit"
which was at the time marketed by Nightmare Software. I had even
read a review of it in the German "Happy Computer" magazine,
which stated "the possibility for a beginner to create viruses"
to be an advantage, and the "rather clumsy user interface" to be
a disadvantage. Makes you think, doesn't it?
Now 'professionally' marketed, "Part II" offered what the old
version had to offer - and probably even more. It had to be
concluded that it was now a doddle to create the most advanced
link viruses, even for quite inexperienced people. Apart from
some ready-prepared virus examples, it was also easy to implement
your own modules with your own destruction-and trigger-routines.
A strange thing was that the last few pages of the manual were
filled with advertisements for "virus protection seminars" and
"virus protection guidance", all of this at rather exorbitant
prices. This didn't strike me as a particularly ethically correct
thing to do.
Not much later, thank God, news became available that the
program was taken off the shelves and never sold again. Nothing
seems to have been heard any more from this company in Bad Soden
am Taunus, either.
4.4 THE GHOST VIRUS
Now probably the most wide-spread virus still abundant is the
Ghost Virus, also known as Mouse Virus because its main symptom
is the reversal of your mouse cursor's vertical movements after a
while. It was first spotted around November 1988 but people still
come across it all the time, even today, although it doesn't work
on TT or Falcon.
At least 10 different versions of it are known to exist, and
that even excludes the TOI Virus, discovered in November of 1990,
of which it was most likely the pre-virus. Six of these different
versions are mutant in some way, meaning that they have been
corrupted while installed in the memory of an infected system,
after which they still seemed to have been able to make a copy of
themselves onto a disk. Infection with them will result either in
your system crashing upon boot-up or data being lost on a disk
that it reproduces itself onto. Three variations on the original
have been made by human hands, for reasons probably varying from
"changing the symptoms in a subtle way" to "no longer making it
detectable by then current virus killers".
The reason why the Ghost Virus is so widespread can be explained
because of two reasons. For starters it is the virus that somehow
succeeded in finding its way onto commercial software and British
Atari magazine cover disks most often (together with, to somewhat
less extent, the Evil Virus and Goblin Virus). Second, the
advanced immunization scheme that the "Ultimate Virus Killer"
uses does not work against the Ghost Virus because that virus
simply copies itself to any bootsector it comes across.
4.5 NON-EXECUTABLE VIRUSES
The next major step in virus evolution on the Atari platform
came in March 1990 when George "VKiller" Woodside discovered the
Bat Virus. This was a new and revolutionary non-executable
bootsector call virus that, at the time, invariably resulted in
all virus killers, even the most modern ones, finding the disk it
had infected to be 100% safe. It did this by using a method not
used nor even conceived possible until then - making sure the
actual disk's bootsector was not executable, such as was
explained in 2.2.2. To make sure it had enough room to actually
contain some more viral code, it was a call virus, too (see 2.4).
Rumour has it that a French journalist writing for the French
"ST Magazine" had instructed some wizkid to create this virus
just in order to see how virus killer programmers would react to
it and how long it would take until they would be able to
recognise and effectively remove it. The only good thing here, at
least, is that I don't think it took very longto get recognised,
not for "VKiller" and the "Ultimate Virus Killer" anyway.
In August 1990, the Horror Virus was spotted. This was quite
similar to the Bat Virus in the way it operated - a non-
executable bootsector call virus, too - but with different
symptoms.
4.6 MS-DOS MIMICING VIRUSES
You are perhaps aware that TOS versions 1.04 and higher format
floppy disks so they are not just readable on an ST but can also
be used on IBM PC and compatibles. Such a disk is referred to as
an "MS-DOS" or "MS-DOS-compatible" disk. During the disk
formatting process, these disks get specific values on the first
two bytes on their bootsector. When it is used on a PC, that
machine checks for these specific values and, when found, it
reckons the disk compatible so data can be written to and read
from it.
In the beginning of 1991, the Wolf Virus was discovered. It is
likely that it had, by that time, already been around for quite a
while, the reason being that it caused the bootsector to start
off with those specific MS-DOS identification bytes. The
"Ultimate Virus Killer" always assumed these were MS-DOS specific
bootsectors that contained nothing of interest to Atari computers
and therefore neglected to check its contents any further, simply
deeming the bootsector 100% safe and free of viruses. After all,
MS-DOS specific bootsectors use a totally different kind of
machine code because they have different main processors (Intel
as opposed to Motorola). It was no use checking MS-DOS code for
ST viral characteristics. Or was it?
This would have been quite right if those first few MS-DOS-
specific codes in a bootsector would have caused the Atari to
crash when used as part of an executable bootsector. However,
they didn't. And that was the trick: The Wolf Virus simply
started directly after those MS-DOS codes because the programmer
knew those codes would not cause a crash. Although the disk was
basically recognised as, well, just any other safe MS-DOS disk,
it did in fact contain a complete bootsector virus.
It didn't take long for the "Ultimate Virus Killer" to be
adapted so that it would check even apparently MS-DOS compatible
disks.
4.7 ENCODING VIRUSES
The Zorro Virus, first found mid 1992, presented the next
generation of viruses, that used yet another method to try to
avoid detection. It didn't just disguise itself as an MS-DOS
compatible disk, but also encoded itself with one of a possible
65,000 random values.
Put more specifically: It ensured that the various existing
algorithms that checked whether an unknown bootsector is a virus
or not were put on the wrong track and considered such
bootsectors 'safe'. The "Ultimate Virus Killer" tries to 'see' if
specific bits of viral code are present in a hitherto unknown
executable bootsector, but if those are in some way encoded then,
of course, they aren't properly identified. The virus itself
would simply decode itself right after having been loaded in
memory, making sure that the viral codes were not recognisable
while on the disk but that they nonetheless worked like they
should once a system's memory had been infected. By using a
possible 65,000 different encoding "keys" (hexadecimal values) it
also made sure that up to 65,000 different versions of itself
could be made. Better recognition routines were built into virus
killers to recognise all potential versions of the Zorro Virus.
Some time later, two further viruses employing this encoding
method were also encountered: Macumba Virus and Zorro Virus B. In
the mean time, encoded bootsectors are decoded by the "Ultimate
Virus Killer", internally, before the program checks it for
specific viral characteristics.
4.8 THE BEILSTEIN VIRUS
Then, in March 1993, the most devious and dangerous virus yet
was found - the Beilstein Virus, a third generation of MS-DOS-
mimicing viruses. Here we had a virus that tried to look like an
MS-DOS compatible disk. Here, also, we had a virus that encoded
itself, with the decoding routines being more variable (both with
regard to location in the bootsector and with regard to the
actual decoding sub-program). The net result of this was that we
had on our hands a virus that could make up to a rather massive
655,360 different versions of itself. This made it very difficult
indeed to properly recognise for virus killer programmers.
However, the Beilstein Virus also broke ground on the level of
the user's sense of security. Perhaps you are one of many people
who safeguard their disks by virus free messages, like the
"Guardian" that "FastCopy Pro" can put on your disk's bootsector;
a short message shows "NO VIRUS" or similar at booting. The
Beilstein Virus, now, could infect a disk and make sure whatever
kind of virus free text would still be displayed after the disk
had been infected! It did this simply by buffering the bootsector
it originally found on the disk it wanted to infect, and make
sure whatever was in the old bootsector was accessed by the
Operating System whenever bootsector access was made (such as
when a virus killer tries to read it). When booting with such an
infected disk in the disk drive, the Beilstein Virus virus would
install itself and then run that old bootsector, too. So after it
had infected your system it would simply also display any "NO
VIRUS" messages you might have had on that disk.
So the Beilstein Virus was definitely the most difficult to
detect. This would not have been such a problem if it had just
been one of those viruses that only inverts the screen colours
or, even, one that only manipulates the vertical mouse cursor
movements. On top of all that, however, it was also a non-
executable bootsector call virus such as the Bat Virus and the
Horror Virus. It is this particular call virus property that
allowed for the Beilstein Virus not just to be the most difficult
one to actually detect but also the one that had access to an
extra large actual virus program so that it could do even more
horrible things than all viruses that came before.
And it did.
Without a doubt, the Beilstein Virus is the most dangerous virus
ever seen pertaining the things it can do to computer, floppy-or
hard-disk. It can demolish a floppy's bootsector, FAT and
directory, making all data inaccessible; delete specific files
when you load them; freeze your system; erase hard disk partition
C (!); corrupt modem and printer output; delete folders; invert
mouse pointer movements like the Ghost Virus. For a complete and
more detailed list of what it can do, you are advised to check
out appendix A.
The Beilstein Virus was written by a student from the town of
Beilstein in Germany, and sent to several virus killer
programmers so that they could update their virus killer's search
and analysis algorithms to cope with this new kind of virus that
might pop up in another form by another virus author somewhere
else some day. Although, obviously, care has been taken to make
sure it didn't 'escape', as it were, reports have been heard of
the Beilstein Virus spotted 'in the wild'.
4.9 THE ULTIMATE VIRUS DESIGNER
Ever since February 1994 I have repeatedly received anonymous
registered packages from one of the former Yugoslavian republics,
Slovenia. Stamped in the main capital Ljubljana, these packages
usually contained a letter of a girl calling herself Lucky Lady
who was, apparently, a virus programmer and member of SSO - the
Slovenian Stonewashing Organisation. She had seen my program and
had seemed to take it on herself to challenge me by creating new
viruses regularly. Because she had really liked my "Ultimate
Virus Killer" and she wanted to give me a fair chance, she sent
me the source code of each of her viruses so that I could
implement recognitions in each new version of the "Ultimate Virus
Killer".
This put me in quite an awkward position. Surely I was intrigued
and even flattered, but I didn't actually like it very much that
I had in some way been responsible for triggering such a
challenge that, inevitably, would lead to other people getting
infected by her viruses and, likely, experiencing data loss of
some sort.
I guess this was a classic case where a famous Dutch proverb
made itself felt: "High trees catch a lot of wind". If I couldn't
cope with events like these, however, no matter how unlikely
their occurrence might have been, I shouldn't have started coding
a virus killer in the first place. Now I just had to go along
with the flow, as it were, and handle rocky outcrops and
waterfalls whenever they happened to present themselves.
Lucky Lady was responsible for several bootsector viruses as
well as a very controversial program called "Ultimate Virus
Designer". This was a GEM-driven program with which, it claimed,
a user could create up to 192 different versions of the UVD
Virus. Some of these worked on old TOS versions only, and some of
them worked on the Falcon, too. Version 1.6 was the only one of
the "Ultimate Virus Designer" to be released to the general
public, in October 1994.
4.10 THE VALKYRIE VIRUS SYSTEM
Lucky Lady's vilest and most dangerous legacy to the Atari world
was the highly destructive and prolific Valkyrie Virus System.
Although she never got round to sending it to me, a friend of
hers typed down her notes and mailed them to me. What
specifications I could glean from these notes have been used to
prepare the "Ultimate Virus Killer" as well as can be.
The Valkyrie Virus was a hybrid link virus that only aimed to
infect files on hard disks. It was initially booted from floppy
disk as a bootsector virus, where it used additional encoded
sectors (the 3 last directory sectors) to call further segments
of it. After that, it would copy itself into a safely allocated
area of memory from where it would patch itself onto several
system vectors and be ready for multiplication. Upon installing
itself in memory, it changed the partition C volume name (disk
name) to "VLKY", encoded by adding the value of the current
date's day to each byte. It did not install itself on systems
without a hard disk, so those were safe.
The Valkyrie Virus copy routine was a really versatile one, and
also key to its hybrid bootsector/link virus state. It got
accessed through a timer routine, every five minutes. If drive A
or B were present it would install itself on there in its hybrid
bootsector virus variety, creating a floppy disk that was all
ready to infect another system. Any other drives (specifically
drive C) would have all files in their AUTO folders infected, in
which case it would behave like a link virus. If the first AUTO
folder file had been infected already, it would infect all
programs in the root directories of all other drives present. If
a LAN or MIDI network was connected, the Valkyrie Virus would
also access the main network boot drive via LAN or MIDI to infect
all files on that device's AUTO folder. Files infected with the
Valkyrie Virus would have their last longword changed to "VLKY".
The Valkyrie Virus used a really nasty way to simultaneously
hide itself and find a way around its problem of not being able
to access write-protected disks. Like most viruses, it
intercepted disk read/write Operating System sub-program calls.
Whenever access was made to the bootsector of a floppy disk -
such as would happen, for example, when a virus killer read its
contents - the Valkyrie Virus would cause it to appear as if it
had been infected by the Kobold #2 Virus, even though this
actually wasn't the case at all. Upon the user write-enabling the
disk and the virus killer attempting to destroy the virus on its
bootsector, the Valkyrie Virus would write a copy of the Lucky
Lady 1.03 Virus on the disk instead. This was quite devious
because it lured the user into write-enabling the disk to get rid
of the Kobold #2 Virus in the first place...
Once an infected file was run from hard disk, the Valkyrie Virus
would check whether the system date equalled January 8th - Lucky
Lady's birthday. When this date was found it would execute the
destruction routine, the main symptom of which was the screen
clearing and the text "I will never love again!" appearing. In
the various different versions that are claimed to exist,
additional symptoms varied: The hard disk drive boot record could
be overwritten; the I/O vectors on TOS 3.0x could be garbled,
disturbing all input and output and most likely causing
unpredictable crashes; if a machine's TOS version matched 4.0x
(i.e. on the Falcon), the virus would randomly write values to
the video chip, ultimately leading to screen display parameters
that could damage (especially VGA) monitors connected; it could
fill the current directory with up to 99,999,999 small text files
containing the text "I will never love again!"; it could randomly
change parts of both disk FATs, corrupting file access; it would
delete the "Ultimate Virus Killer" main program file whenever
this program was run. And one version of the Valkyrie Virus
believed to exist also appeared to do something special with
ET4000 graphics card registers.
From autumn 1994 on, Lucky Lady occasionally corresponded with
me via email, using a hacked account at the University of
Ljubljana where she studied psychology. It developed into a
really strange but unique kind of pen pal relationship,
especially after she had abandoned writing viruses on the Atari
platform. Whereas she used to be an optimistic and vibrant person
- no matter if she used her incredible talents for things
ethically astray - she got into an ever deepening pit of despair
and personal problems in spring of 1995. Her email messages
became really depressing, sometimes literally claiming she wanted
to embrace death. In June, just after I had sent her some more
email, I found out that she had died earlier that month.
She was aged 22.
