Acorn Virus in the early 90’s

discuss general risc os software applications and utilities
Related forum: adventures


Post Reply
User avatar
DaveLecky
Posts: 227
Joined: Mon Jul 08, 2019 7:52 am
Location: Airdrie, Scotland
Contact:

Acorn Virus in the early 90’s

Post by DaveLecky » Sat Jun 20, 2020 9:24 pm

Hi Folks,

Does anyone remember the virus that was spread within a programme on a magazine cover disc in the 1990’s.1992 rings a bell.

Was it within an Archimedes World disc. ?

I got some old AW cover discs On eBay and my memory was jogged, I remember having to wait a month until the removal tool was included in the next issue.

I thought it would be funny if I loaded one of these discs and reinfected myself yet again.

I would really like to find out which magazine issue the virus and antidote was on.....can anyone help me with my puzzle.?

Thanks

Dave
Electron Plus 3 and plus 1, AP6 and Home made MMFS PP SD interface
Electron Plus 1 Pres AP3/4
Beeb issue 7 with IFEL 16 socket Rom/Ram board
Master 128, BooBip multi OS,IFEL SD card
StrongA RPC, A3020
Atom

joachim
Posts: 181
Joined: Wed Jun 21, 2006 2:20 am
Location: Germany
Contact:

Re: Acorn Virus in the early 90’s

Post by joachim » Sat Jun 20, 2020 9:37 pm

According to the Archimedes Virus Reference Document (http://www.bogus.net/~torh/files/AVRD-1.91t.txt, other copies also findable on Google), you're most likely referring to a virus called "Module" or "ModVir":
AVRD wrote:Module
===========================================================================

Last Updated: 11th September 1992
Aliases: Illegal, ModVir
Origin: Unknown
Isolation Date: October 1991
Effective Length: 956 bytes
Virus Type: Resident module infector.
Symptoms: Modules grow by approx. 1k, and are re-datestamped.
May cause system crashes when accessing files
(load, save, etc.

---------------------------------------------------------------------------

Detection Media: Killer 1.17+ Memory: Interferon 2.00+
Hunter 1.00+ Killer 1.17+
Scanner 1.14+ Hunter 1.00+
VProtect 1.10+

Removal Media: Killer 1.26+ Memory: Killer 1.26+
Hunter 1.00+ Hunter 1.00+
Scanner 1.46+

---------------------------------------------------------------------------

General Comments:

This is a very nicely written virus which appends itself to modules,
redirecting three module entry points to pass through itself before
being handed on to the module's original entry point. It spreads
by infecting a module as it is loaded, and then the newly loaded
module infects the next one loaded, and so on...

This virus is likely to be very widespread, since it was distributed
on the Archimedes World February 1992 cover disc in the MicroDrive
demo (in it, several modules were infected). It does nothing until
6th September 1992, when it will display the message:

Your computer has been virus infected. This is intended to be a friendly
virus, and hasn't done any damage to your disc as is possible now,
but it isn't active anymore from now on. Be more careful with illegal
software next time!

[Along with a generation counter. Another interesting observation
is that it does not infect locked modules. Infects whenever it notices
a RUN or LOAD action on a module. As a result, THIS VIRUS IS EXTREMELY
CONTAGIOUS.]

The message that it isn't active anymore is not true! It ALWAYS (even
after 06-Sep-1992) attaches itself to the OS_File (FileV) vector.

The virus first calls the previous owner of the OS_File vector (FileSwitch?).
This means that the module will be loaded and initialised. If the
length of the module minus the initialise word of the module is equal
to 956 (i.e. the length of the virus), then the module is already
infected and the virus deactivates itself (the newly loaded module
has already attached itself to the OS_File vector). If the module
isn't infected, the virus attaches itself at the end of the module,
overwriting the init/final/service words in the module header, preserving
the original 3 words.

(Source: Alan Glover, Michel Fasen)

User avatar
DaveLecky
Posts: 227
Joined: Mon Jul 08, 2019 7:52 am
Location: Airdrie, Scotland
Contact:

Re: Acorn Virus in the early 90’s

Post by DaveLecky » Sat Jun 20, 2020 9:52 pm

Thanks for the info,
Now I know, I’ll have to try and find an original copy of the disc......just for the hell of it.

Dave
Electron Plus 3 and plus 1, AP6 and Home made MMFS PP SD interface
Electron Plus 1 Pres AP3/4
Beeb issue 7 with IFEL 16 socket Rom/Ram board
Master 128, BooBip multi OS,IFEL SD card
StrongA RPC, A3020
Atom

thecellartroll
Posts: 240
Joined: Thu Nov 24, 2011 10:43 pm
Contact:

Re: Acorn Virus in the early 90’s

Post by thecellartroll » Sun Jun 28, 2020 11:49 pm

Anyone else had a school infested with the cursed "Icon" virus? I spent so many lunchtimes immunising machines against it (a directory in each !folder called Icon).

User avatar
flaxcottage
Posts: 4252
Joined: Thu Dec 13, 2012 8:46 pm
Location: Derbyshire
Contact:

Re: Acorn Virus in the early 90’s

Post by flaxcottage » Mon Jun 29, 2020 7:50 am

I remember that one 'fondly'. To automate things I wrote a short immunisation program that loaded on boot from the network and which automatically inoculated any disks inserted - a kind of anti-virus virus. :lol:
- John

Image

User avatar
BeebMaster
Posts: 3622
Joined: Sun Aug 02, 2009 5:59 pm
Location: Lost in the BeebVault!
Contact:

Re: Acorn Virus in the early 90’s

Post by BeebMaster » Mon Jun 29, 2020 1:57 pm

I remember seeing at the Wakefield charity stand a few years back a disc or CD which had a warning label saying this software is infected with such-a-virus, but it's harmless. I thought it was Icon or Extend, can't remember now.
Image

SteveF
Posts: 720
Joined: Fri Aug 28, 2015 9:34 pm
Contact:

Re: Acorn Virus in the early 90’s

Post by SteveF » Mon Jun 29, 2020 9:31 pm

DaveLecky wrote:
Sat Jun 20, 2020 9:52 pm
Thanks for the info,
Now I know, I’ll have to try and find an original copy of the disc......just for the hell of it.
I remember this; I deliberately saved a copy of the disc with the virus and amazingly enough I've managed to find it. Are you still looking for it or did you get a copy somewhere else? It seems to be Archimedes World April 1992. Edited to add: I appreciate this isn't consistent with what was posted above, but that's what the disc name suggests. The infection seems to be in the !FileTree application in the PD folder, though it may be in other places too. This is based on the VKiller bundled with rpcemu issuing a warning when I double click that app.

My recollection is that I never got hit by this virus, because there was a warning attached to the magazine somehow. I'm not sure what happened, maybe I had a subscription and they put a slip of paper in with the mailing.

Moderators/admins: am I allowed to upload this disc image, given it does have a virus on?

Edited to add: Turns out - after I dug through my old floppies and fired up the aging PC I use to read them - I had it all nicely archived on my hard drive already anyway. That's life. :-)
Last edited by SteveF on Wed Jul 01, 2020 1:04 pm, edited 1 time in total.

User avatar
DaveLecky
Posts: 227
Joined: Mon Jul 08, 2019 7:52 am
Location: Airdrie, Scotland
Contact:

Re: Acorn Virus in the early 90’s

Post by DaveLecky » Tue Jun 30, 2020 8:59 am

Hi Steve, yes I would like a copy, haven’t managed to find an original yet.

Dave
Electron Plus 3 and plus 1, AP6 and Home made MMFS PP SD interface
Electron Plus 1 Pres AP3/4
Beeb issue 7 with IFEL 16 socket Rom/Ram board
Master 128, BooBip multi OS,IFEL SD card
StrongA RPC, A3020
Atom

Post Reply

Return to “32-bit acorn software: other”