Mouse (Inverter) Virus

Alias:Ghost
Strain:---
detected when:---
where:---
Classification:System (BootSector) Virus, Reset-resident, Overwriting
Length:512 Byte

Preconditions

Operating System(s):ATARI-TOS
Version/Release:All Version of TOS
Computer model(s):All types of the Atari ST Series
Caroname:Mouse

Attributes

Easy identification:---

Type of Infection:

Self-Identification: The Virus tests adresse $140 for the first Virus instruction; virus installs itself reset- and RAMresident if virus code does not match.

Infection Technique:
Infection Trigger:Each time a new diskette is inserted, the virus will infect the new diskette.
Storage Media affected:The virus infect drive A,B!
Interrupts hooked:No Interrupts used. Resetvector for installation changed. hdv_bpb changed to infect Bootsector of new Disk.
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:
Encoding Method:
Damage:Permanent Damage: Overwriting Bootsectors. Transient Damage: Inverting Mouse Up-Down Moving- direction.
Damage Trigger:Damage Action after 10 infections. Always after 5 new infections,the Mouse Movingdirection is again inverted.
Particularities:---
Similarities:---

Agents

Countermeasures:Poke instruction 'move.l #$D6,d3' to adresse $140 (this excludes Virus' installation).
Standard means:Write-protect the disk. Write a well-known program to the boot sector; 'manually' change the checksum to a value other than $1234.

Acknowledgements

Location:Virus Test Center, University Hamburg, FRG
Classification by:Thomas Piehl
Documentation by:Thomas Piehl
Date:Nov. 11,1989
Information Source:---

(c) 1996 Virus-Test-Center, University of Hamburg