All about viruses

All about the serious stuff.

Moderators: Mug UK, Zorro 2, Moderator Team

Post Reply
Dal
Administrator
Administrator
Posts: 4199
Joined: Tue Jan 18, 2011 12:31 am
Location: Cheltenham, UK
Contact:

All about viruses

Post by Dal »

I have been wondering whether anyone has researched the murky world of ST viruses?
It seems to be the one remaining part of the STs history with little information.

Specifically, it would be intriguing to know where they originated, known coders, behaviour, source code and binaries or infected disk images - for those of us who might want to see them in action in a controlled environment.
STE: Desktopper case, IDE interface, UltraSatan (8GB + 512Mb) + HXC floppy emulator. Plus some STE's/STFM's
User avatar
AtariCrypt
Captain Atari
Captain Atari
Posts: 410
Joined: Fri Mar 14, 2014 5:04 pm
Location: Lancashire, England
Contact:

Re: All about viruses

Post by AtariCrypt »

A fascinating topic, especially the history and who done it aspects. (thankfully, I think I only ever came across the ghost virus...)
AtariCrypt game website
https://ataricrypt.blogspot.com
Dal
Administrator
Administrator
Posts: 4199
Joined: Tue Jan 18, 2011 12:31 am
Location: Cheltenham, UK
Contact:

Re: All about viruses

Post by Dal »

Yes, I think everyone had the Ghost virus at some point.

This is all I ever found:
http://uvk2000.com/viruses.html

Probably the most comprehensive list of ST viruses so serves as a good starting point.
STE: Desktopper case, IDE interface, UltraSatan (8GB + 512Mb) + HXC floppy emulator. Plus some STE's/STFM's
Dal
Administrator
Administrator
Posts: 4199
Joined: Tue Jan 18, 2011 12:31 am
Location: Cheltenham, UK
Contact:

Re: All about viruses

Post by Dal »

I've reached out to Richard Karsmakers (developer of UVK) - maybe he can help. If there's enough information around, I'll create a page about it.
STE: Desktopper case, IDE interface, UltraSatan (8GB + 512Mb) + HXC floppy emulator. Plus some STE's/STFM's
User avatar
AtariCrypt
Captain Atari
Captain Atari
Posts: 410
Joined: Fri Mar 14, 2014 5:04 pm
Location: Lancashire, England
Contact:

Re: All about viruses

Post by AtariCrypt »

Excellent link, there is so much! Time to run UVK I think! (I won a lot of eBay and that was part of it. Original cover too!)
...I better start scanning 8O
AtariCrypt game website
https://ataricrypt.blogspot.com
User avatar
Zogging Hell
Atari Super Hero
Atari Super Hero
Posts: 892
Joined: Sat Apr 29, 2006 12:08 pm
Location: Bristol, UK
Contact:

Re: All about viruses

Post by Zogging Hell »

Think I collected a few on disk which I still somewhere, a variant of the Ghost virus and possibly Green Goblin virus I think from memory (they might even have been MSA'd if the images survived my hard drive crash a few years back). Most people would have tried to kill them off, so I imagine some of the rarer ones are now extinct. I thought I might be slightly bonkers for trying to collect them as well..

There was also a virus construction set wasn't there which quite a few virii came from.
Firebee, Falcon CT60, Milan 040, Falcon MkI, TT, Mega STe, Mega ST + Lots of STs of various flavours
User avatar
Zogging Hell
Atari Super Hero
Atari Super Hero
Posts: 892
Joined: Sat Apr 29, 2006 12:08 pm
Location: Bristol, UK
Contact:

Re: All about viruses

Post by Zogging Hell »

Dal wrote:I've reached out to Richard Karsmakers (developer of UVK) - maybe he can help. If there's enough information around, I'll create a page about it.
Didn't he write a whole book on the subject?
Firebee, Falcon CT60, Milan 040, Falcon MkI, TT, Mega STe, Mega ST + Lots of STs of various flavours
joska
Hardware Guru
Hardware Guru
Posts: 4703
Joined: Tue Oct 30, 2007 2:55 pm
Location: Florø, Norway
Contact:

Re: All about viruses

Post by joska »

Dal wrote:Yes, I think everyone had the Ghost virus at some point.
I actually had the Ghost virus less than two months ago :D I was looking through a bunch of old disks I got with an ST I bought some ten years ago and suddenly the mouse started moving in reverse. Memories :)
Jo Even

VanillaMiNT - Firebee - Falcon060 - Milan060 - Falcon040 - MIST - Mega ST - STM - STE - Amiga 600 - Sharp MZ700 - MSX - Amstrad CPC - C64
User avatar
purpleeagle01
Captain Atari
Captain Atari
Posts: 306
Joined: Mon Jul 19, 2004 9:42 am
Location: Wien

Re: All about viruses

Post by purpleeagle01 »

The Medway Boys Bootprotector III is not a virus just the menus with this Bootprotector work not on STE
The Most Good things beginning with the letter A
Like Atari Austria Wien(My Favorite Soccer Team)
simonsunnyboy
Moderator
Moderator
Posts: 5235
Joined: Wed Oct 23, 2002 4:36 pm
Location: Friedrichshafen, Germany
Contact:

Re: All about viruses

Post by simonsunnyboy »

Interesting topic, I'm waiting for your page, Dal. I encoutered only the Ghost Virus but that one infected basically 80% of my old disks. I remember the first thing to do at the dawn of emulator age in 1997/98 was to place anti virus bootblocks and protectors on my images and disks. Pesky Ghost even did spread on my .MSA and .St files. I maybe still have a copy somehwere in my vaults.
purpleeagle01 wrote:The Medway Boys Bootprotector III is not a virus just the menus with this Bootprotector work not on STE
I think it crashes on STFM with more than 1MB RAM too.
Simon Sunnyboy/Paradize - http://paradize.atari.org/

Stay cool, stay Atari!

1x2600jr, 1x1040STFm, 1x1040STE 4MB+TOS2.06+SatanDisk, 1xF030 14MB+FPU+NetUS-Bee
User avatar
Mug UK
Administrator
Administrator
Posts: 11516
Joined: Thu Apr 29, 2004 7:16 pm
Location: Stockport (UK)
Contact:

Re: All about viruses

Post by Mug UK »

Eee them were the days :)

I remember when ST Format rang me up in a panic asking for a quick way to detect the Green Goblins virus in memory.

I sent them some code in GFA and the lovely LPEEK(LPEEK(systemvar)) command .. or was it assembly - I can't remember now. It was over 20 years ago :)
My main site: http://www.mug-uk.co.uk - slowly digging up the bits from my past (and re-working a few): Atari ST, Sega 8-bit (game hacks) and NDS (Music ripping guide).

I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
User avatar
aktiv8
Atari God
Atari God
Posts: 1490
Joined: Tue Mar 04, 2003 4:31 pm
Location: Cardiff, South Wales

Re: All about viruses

Post by aktiv8 »

For anyone wanting to look more at he code of many viruses and the Ultimate Virus Designer take a look at http://vxheaven.org/exotic.php

Even has a new-ish (2009) virus developed using the Hatari emulator

ST Virus List included are:

Cookie; c't; directory waster; evil nick; flying chimp; freeze; ghost; green goblins; kobold; mad; merlins mad; muncher; oli; pirate trap; screen; signum; toi; uvd; virus master; zeldas

The Ultimate Virus Designer (UVD 1.6), Lucky Lady, 1994 (Lucky lady is the late Katja Kladnik - see http://spth.virii.lu/coderz1/lucky.html)

Boot sector Construction Set (BCS 1.64), 1992

ST2AB, Lord (A0), 2009
>>> Trust me, I'm a Research Chemist.... <<<
User avatar
Maartau
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2630
Joined: Thu Dec 15, 2005 2:15 am
Location: Uranus of ze Fronce

Re: All about viruses

Post by Maartau »

I'm wondering if somebody have the VCS aka "Virus Construction Set" from Germany :cheers: .

http://www.stcarchiv.de/hc1988/05_vcs.php
“It is no measure of health to be well adjusted to a profoundly sick society.”
User avatar
AdamK
Captain Atari
Captain Atari
Posts: 327
Joined: Wed Aug 21, 2013 8:44 am

Re: All about viruses

Post by AdamK »

I recently talked with Richard about UVK and he sent me full sources. He does not have virus database (bootsector dumps), UVK uses a somehow clever way of deducing what is inside bootsector using special matching scripts (go to byte #n, check for value $x, etc).
Atari: FireBee, Falcon030 + CT60e + SuperVidel + SvEthlana, TT, 520ST + 4MB ST RAM + 8MB TT RAM + CosmosEx + SC1435, 1040STFM + UltraSatan + SM124, 1040STE 4MB ST RAM + 8MB TT RAM + CosmosEx + NetUSBee + SM144 + SC1224, 65XE + U1MB + VBXE + SIDE2, Jaguar, Lynx II, 2 x Portfolio (HPC-006)

Adam Klobukowski [adamklobukowski@gmail.com]
User avatar
Mug UK
Administrator
Administrator
Posts: 11516
Joined: Thu Apr 29, 2004 7:16 pm
Location: Stockport (UK)
Contact:

Re: All about viruses

Post by Mug UK »

That's what mine did too. I had a hidden key which would dump the bootsector's contents to screen and a file so that I could examine them.

You got used to looking for particular sets of bytes - especially those that attached themselves to the floppy routines and were reset proof. Whilst PVK never came up to the same level as UVK, it was an interesting experience in GFA BASIC and some (fairly simple) 68000.
My main site: http://www.mug-uk.co.uk - slowly digging up the bits from my past (and re-working a few): Atari ST, Sega 8-bit (game hacks) and NDS (Music ripping guide).

I develop a free Word (for Windows) add-in that's available for Word 2007 upwards. It's a fix-it toolbox that will allow power Word users to fix document errors. You can find it at: http://www.mikestoolbox.co.uk
User avatar
Cronos
Atari maniac
Atari maniac
Posts: 83
Joined: Mon Jul 22, 2002 8:30 am
Location: Gouda, The Netherlands
Contact:

Re: All about viruses

Post by Cronos »

I don't have any actual viruses anymore, so the two other resources I can point you towards are:

http://uvk2000.com/viruses.html
This is the list of all viruses known to me until I stopped doing UVK updates. I no longer maintain this site, in fact someone took over its registration and now seems to use a bare-bones version of this site (without downloads, hence the broken link) to sell VPNs to people.

http://www.st-news.com/loax/uvk_book.zip
This is an ST executable using the ST NEWS interface to view the UVK Book. This is the text of the book minus the pictures.

http://www.st-news.com/loax/UVK_2000.zip
The download of the final version of the UVK.

Sorry I can't help you any further. If you have specific questions I may be able to find an answer. But, like Mug UK said, it's been a while so memories have got hazy.
Richard Karsmakers

http://www.STNICCC.com (1990, 2000, 2015, 2032 :-))
http://www.ST-NEWS.com (1986-1996)
"Ultimate Virus Killer 2000" (1987-2004)
Post Reply

Return to “Applications”