The Amiga Virus
Jim Butterfield, Contributing Editor
The Amiga has been the victim of a hacker's practical joke. A group of programmers from Europe developed a small program that affects Amiga Workbench disks. This not-so-harmless virus recently caused quite a stir at The World of Commodore show in Toronto, Canada. Jim Butterfield explains.
Some call it a minor annoyance. Some call it a serious hazard. Either way, a small system program found on some Amiga disks became wide-spread at The World of Commodore show in Toronto, Canada. This "virus" spreads from disk to disk without the user's knowledge and can "infect" an entire library before it makes itself known.
The World of Commodore show did not spawn this software infection. The virus comes from a group in Switzerland called SCA, so it's sometimes called the SCA virus. At least one other version (a mutation) exists. It has been known in Europe for some time, and it's believed to have made its way to North America from Germany in late October 1987.
Spreading The Virus
The virus affects Amiga Workbench disks. If you boot with an infected disk, the virus program installs itself into the computer's memory. To further spread the infection, this program wedges itself into the Amiga's reboot code.
The virus waits benignly until the user gives the three-key Amiga reboot sequence. That's the one where you press the CTRL, Commodore, and Amiga keys together. On the Amiga 1000, it's the CTRL, left-Amiga, and right-Amiga keys. The virus survives the reboot and plants itself onto the boot track of the current Workbench disk.
Most users think that the three-key reboot makes the system start over, cleaning out any previous code. Not so with the virus: It stays in there, waiting to infect your next boot disk. And after a number of computer reboots, the virus prints a message such as: A wonderful thing has happened. Your Amiga is alive! And, even better, some of your disks are infected by a virus!
Diagnosing The Virus
Is the virus harmless? Not quite. Some commercial programs use disk copy-protection systems that live in the same area that the virus invades. If the virus spreads too far (infects too many disks), you could lose some of your most valuable programs. And there's another danger. With certain Amiga memory configurations, the virus mistakenly loads itself into the wrong place, thus causing a system failure.
How can you tell if any of your disks have the virus? There are programs available that analyze your disks, but there's an easier way: Insert the suspected Workbench disk, hold down the left mouse button, and reset your computer using the three-key reboot. If there is a virus in memory, the screen flashes green for about half a second as the computer begins to reboot.
There may be certain strains of the virus that do not exhibit this tell-tale green flash. For this reason, we offer "Vlook." Vlook is a short Amiga Basic program that checks the computer's memory for the virus. When you have typed in and saved the program, run it.
Vlook creates a program file on the Amiga's RAM disk. You may copy this file to the disk in drive 0 by activating the CLI and typing:
COPY RAM : VLOOK DFO:
To run the program and test your computer's memory, enter this instruction from the CLI:
RAM : VLOOK
If your computer is infected, the warning Memory contains a known VIRUS appears. Otherwise you'll see "Memory contains no signs of a known virus." If you receive the first message, one or possibly all of your boot disks are infected.
The Antidote
How can you get rid of the virus? If your disk does not contain a commercial protection scheme, the CLI command INSTALL can rid your infected boot disks of the virus. To clear the virus from the Workbench disk in drive 0, for example, enter INSTALL DF0: from the CLI. Do not use INSTALL if your disk has a copy-protection scheme, since this would probably render the disk useless.
Non-Workbench disks (disks that do not boot the computer) cannot be infected by the virus. Also, if you keep your Workbench disks write-protected, the virus does not affect them—an effective method of immunization.
Even after you clean up a disk, the virus remains in memory. To flush the virus from the computer's memory, shut the computer off and leave it off for at least a minute before rebooting.