All about viruses
Moderators: Mug UK, Zorro 2, Moderator Team
All about viruses
I have been wondering whether anyone has researched the murky world of ST viruses?
It seems to be the one remaining part of the STs history with little information.
Specifically, it would be intriguing to know where they originated, known coders, behaviour, source code and binaries or infected disk images - for those of us who might want to see them in action in a controlled environment.
It seems to be the one remaining part of the STs history with little information.
Specifically, it would be intriguing to know where they originated, known coders, behaviour, source code and binaries or infected disk images - for those of us who might want to see them in action in a controlled environment.
STE: Desktopper case, IDE interface, UltraSatan (8GB + 512Mb) + HXC floppy emulator. Plus some STE's/STFM's
- AtariCrypt
- Captain Atari
- Posts: 421
- Joined: Fri Mar 14, 2014 5:04 pm
- Location: Lancashire, England
- Contact:
Re: All about viruses
A fascinating topic, especially the history and who done it aspects. (thankfully, I think I only ever came across the ghost virus...)
AtariCrypt game website
https://ataricrypt.blogspot.com
https://ataricrypt.blogspot.com
Re: All about viruses
Yes, I think everyone had the Ghost virus at some point.
This is all I ever found:
http://uvk2000.com/viruses.html
Probably the most comprehensive list of ST viruses so serves as a good starting point.
This is all I ever found:
http://uvk2000.com/viruses.html
Probably the most comprehensive list of ST viruses so serves as a good starting point.
STE: Desktopper case, IDE interface, UltraSatan (8GB + 512Mb) + HXC floppy emulator. Plus some STE's/STFM's
Re: All about viruses
I've reached out to Richard Karsmakers (developer of UVK) - maybe he can help. If there's enough information around, I'll create a page about it.
STE: Desktopper case, IDE interface, UltraSatan (8GB + 512Mb) + HXC floppy emulator. Plus some STE's/STFM's
- AtariCrypt
- Captain Atari
- Posts: 421
- Joined: Fri Mar 14, 2014 5:04 pm
- Location: Lancashire, England
- Contact:
Re: All about viruses
Excellent link, there is so much! Time to run UVK I think! (I won a lot of eBay and that was part of it. Original cover too!)
...I better start scanning
...I better start scanning

AtariCrypt game website
https://ataricrypt.blogspot.com
https://ataricrypt.blogspot.com
- Zogging Hell
- Atari Super Hero
- Posts: 894
- Joined: Sat Apr 29, 2006 12:08 pm
- Location: Bristol, UK
- Contact:
Re: All about viruses
Think I collected a few on disk which I still somewhere, a variant of the Ghost virus and possibly Green Goblin virus I think from memory (they might even have been MSA'd if the images survived my hard drive crash a few years back). Most people would have tried to kill them off, so I imagine some of the rarer ones are now extinct. I thought I might be slightly bonkers for trying to collect them as well..
There was also a virus construction set wasn't there which quite a few virii came from.
There was also a virus construction set wasn't there which quite a few virii came from.
Firebee, Falcon CT60, Milan 040, Falcon MkI, TT, Mega STe, Mega ST + Lots of STs of various flavours
- Zogging Hell
- Atari Super Hero
- Posts: 894
- Joined: Sat Apr 29, 2006 12:08 pm
- Location: Bristol, UK
- Contact:
Re: All about viruses
Didn't he write a whole book on the subject?Dal wrote:I've reached out to Richard Karsmakers (developer of UVK) - maybe he can help. If there's enough information around, I'll create a page about it.
Firebee, Falcon CT60, Milan 040, Falcon MkI, TT, Mega STe, Mega ST + Lots of STs of various flavours
Re: All about viruses
I actually had the Ghost virus less than two months agoDal wrote:Yes, I think everyone had the Ghost virus at some point.


Jo Even
VanillaMiNT - Falcon060 - Milan060 - Falcon040 - MIST - Mega STE - Mega ST - STM - STE - Amiga 600 - Sharp MZ700 - MSX - Amstrad CPC - C64
VanillaMiNT - Falcon060 - Milan060 - Falcon040 - MIST - Mega STE - Mega ST - STM - STE - Amiga 600 - Sharp MZ700 - MSX - Amstrad CPC - C64
- purpleeagle01
- Captain Atari
- Posts: 306
- Joined: Mon Jul 19, 2004 9:42 am
- Location: Wien
Re: All about viruses
The Medway Boys Bootprotector III is not a virus just the menus with this Bootprotector work not on STE
The Most Good things beginning with the letter A
Like Atari Austria Wien(My Favorite Soccer Team)
Like Atari Austria Wien(My Favorite Soccer Team)
-
- Moderator
- Posts: 5309
- Joined: Wed Oct 23, 2002 4:36 pm
- Location: Friedrichshafen, Germany
- Contact:
Re: All about viruses
Interesting topic, I'm waiting for your page, Dal. I encoutered only the Ghost Virus but that one infected basically 80% of my old disks. I remember the first thing to do at the dawn of emulator age in 1997/98 was to place anti virus bootblocks and protectors on my images and disks. Pesky Ghost even did spread on my .MSA and .St files. I maybe still have a copy somehwere in my vaults.
I think it crashes on STFM with more than 1MB RAM too.purpleeagle01 wrote:The Medway Boys Bootprotector III is not a virus just the menus with this Bootprotector work not on STE
Simon Sunnyboy/Paradize - http://paradize.atari.org/
Stay cool, stay Atari!
1x2600jr, 1x1040STFm, 1x1040STE 4MB+TOS2.06+SatanDisk, 1xF030 14MB+FPU+NetUS-Bee
Stay cool, stay Atari!
1x2600jr, 1x1040STFm, 1x1040STE 4MB+TOS2.06+SatanDisk, 1xF030 14MB+FPU+NetUS-Bee
- Mug UK
- Administrator
- Posts: 11560
- Joined: Thu Apr 29, 2004 7:16 pm
- Location: Stockport (UK)
- Contact:
Re: All about viruses
Eee them were the days 
I remember when ST Format rang me up in a panic asking for a quick way to detect the Green Goblins virus in memory.
I sent them some code in GFA and the lovely LPEEK(LPEEK(systemvar)) command .. or was it assembly - I can't remember now. It was over 20 years ago

I remember when ST Format rang me up in a panic asking for a quick way to detect the Green Goblins virus in memory.
I sent them some code in GFA and the lovely LPEEK(LPEEK(systemvar)) command .. or was it assembly - I can't remember now. It was over 20 years ago

My main site: http://www.mug-uk.co.uk - slowly digging up the bits from my past (and re-working a few): Atari ST, Sega 8-bit (game hacks) and NDS (Music ripping guide).
I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
Re: All about viruses
For anyone wanting to look more at he code of many viruses and the Ultimate Virus Designer take a look at http://vxheaven.org/exotic.php
Even has a new-ish (2009) virus developed using the Hatari emulator
ST Virus List included are:
Cookie; c't; directory waster; evil nick; flying chimp; freeze; ghost; green goblins; kobold; mad; merlins mad; muncher; oli; pirate trap; screen; signum; toi; uvd; virus master; zeldas
The Ultimate Virus Designer (UVD 1.6), Lucky Lady, 1994 (Lucky lady is the late Katja Kladnik - see http://spth.virii.lu/coderz1/lucky.html)
Boot sector Construction Set (BCS 1.64), 1992
ST2AB, Lord (A0), 2009
Even has a new-ish (2009) virus developed using the Hatari emulator
ST Virus List included are:
Cookie; c't; directory waster; evil nick; flying chimp; freeze; ghost; green goblins; kobold; mad; merlins mad; muncher; oli; pirate trap; screen; signum; toi; uvd; virus master; zeldas
The Ultimate Virus Designer (UVD 1.6), Lucky Lady, 1994 (Lucky lady is the late Katja Kladnik - see http://spth.virii.lu/coderz1/lucky.html)
Boot sector Construction Set (BCS 1.64), 1992
ST2AB, Lord (A0), 2009
>>> Trust me, I'm a Research Chemist.... <<<
Re: All about viruses
I'm wondering if somebody have the VCS aka "Virus Construction Set" from Germany
.
http://www.stcarchiv.de/hc1988/05_vcs.php

http://www.stcarchiv.de/hc1988/05_vcs.php
Re: All about viruses
I recently talked with Richard about UVK and he sent me full sources. He does not have virus database (bootsector dumps), UVK uses a somehow clever way of deducing what is inside bootsector using special matching scripts (go to byte #n, check for value $x, etc).
Atari: FireBee, Falcon030 + CT60e + SuperVidel + SvEthlana, TT, 520ST + 4MB ST RAM + 8MB TT RAM + CosmosEx + SC1435, 1040STFM + UltraSatan + SM124, 1040STE 4MB ST RAM + 8MB TT RAM + CosmosEx + NetUSBee + SM144 + SC1224, 65XE + U1MB + VBXE + SIDE2, Jaguar, Lynx II, 2 x Portfolio (HPC-006)
Adam Klobukowski [adamklobukowski@gmail.com]
Adam Klobukowski [adamklobukowski@gmail.com]
- Mug UK
- Administrator
- Posts: 11560
- Joined: Thu Apr 29, 2004 7:16 pm
- Location: Stockport (UK)
- Contact:
Re: All about viruses
That's what mine did too. I had a hidden key which would dump the bootsector's contents to screen and a file so that I could examine them.
You got used to looking for particular sets of bytes - especially those that attached themselves to the floppy routines and were reset proof. Whilst PVK never came up to the same level as UVK, it was an interesting experience in GFA BASIC and some (fairly simple) 68000.
You got used to looking for particular sets of bytes - especially those that attached themselves to the floppy routines and were reset proof. Whilst PVK never came up to the same level as UVK, it was an interesting experience in GFA BASIC and some (fairly simple) 68000.
My main site: http://www.mug-uk.co.uk - slowly digging up the bits from my past (and re-working a few): Atari ST, Sega 8-bit (game hacks) and NDS (Music ripping guide).
I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
- Cronos
- Atari maniac
- Posts: 86
- Joined: Mon Jul 22, 2002 8:30 am
- Location: Gouda, The Netherlands
- Contact:
Re: All about viruses
I don't have any actual viruses anymore, so the two other resources I can point you towards are:
http://uvk2000.com/viruses.html
This is the list of all viruses known to me until I stopped doing UVK updates. I no longer maintain this site, in fact someone took over its registration and now seems to use a bare-bones version of this site (without downloads, hence the broken link) to sell VPNs to people.
http://www.st-news.com/loax/uvk_book.zip
This is an ST executable using the ST NEWS interface to view the UVK Book. This is the text of the book minus the pictures.
http://www.st-news.com/loax/UVK_2000.zip
The download of the final version of the UVK.
Sorry I can't help you any further. If you have specific questions I may be able to find an answer. But, like Mug UK said, it's been a while so memories have got hazy.
http://uvk2000.com/viruses.html
This is the list of all viruses known to me until I stopped doing UVK updates. I no longer maintain this site, in fact someone took over its registration and now seems to use a bare-bones version of this site (without downloads, hence the broken link) to sell VPNs to people.
http://www.st-news.com/loax/uvk_book.zip
This is an ST executable using the ST NEWS interface to view the UVK Book. This is the text of the book minus the pictures.
http://www.st-news.com/loax/UVK_2000.zip
The download of the final version of the UVK.
Sorry I can't help you any further. If you have specific questions I may be able to find an answer. But, like Mug UK said, it's been a while so memories have got hazy.
Richard Karsmakers
http://www.STNICCC.com (1990, 2000, 2015, 2032
)
http://www.ST-NEWS.com (1986-1996)
"Ultimate Virus Killer 2000" (1987-2004)
http://www.STNICCC.com (1990, 2000, 2015, 2032

http://www.ST-NEWS.com (1986-1996)
"Ultimate Virus Killer 2000" (1987-2004)