Interesting virus?

[cosmiq]

I have put a file (simcity_virus adf) into the zone. It conains the Simcity game with a virus. This virus has made me angry since I was little:

Somehow, fresh disks are becoming unusable because of the "Disk is not validated" requester. I think this virus is the cause.

If you run WinUAE with the action replay rom, boot the disk and go into replay, you will see that there is a resident program at C7E1A8. There's a text in the code that sais : 'saddam, virus, trackdisk and diskvalidator' stuff.

Can someone confirm that this is the cause of my trouble? A lot of disks have become unable to write so be carefull with this virus. I tried to read the disassembled code but it's too hard for me.

Also, I'm BEGGING for a solution to fix my infected disks. I think it needs some kind of disk doctor to fix the validation issue, and a scanner to remove the virus. But I don't know where to start. This is the first time I have ever concerned viruses on my amiga, since in my younger years I didn't understand what was happening at all....

[DDNI]

Hi check out the Amiga virus Encyclopaedia

http://www.vht-dk.dk/vhtdk/amiga/desc/all.htm

[NLS]

WHAT - an ADF with a virtus in the zone!?

QUICK clear out all the other files from there before they get infected!

And the forum software!

And mods!

[Jope]

Just use any Amiga antivirus software to clean out Saddam.

There were also dedicated killers like Nuke.

[formater]

The virus Saddam isn't a boot virus, is a file virus and replace the L/DISK-VALIDATOR with a nasty one.
Is very dificult clear the disk manually because some traks on the disk are changed, and the better form of clean the disk is with an antivirus. Whichever of the recent antivirus can do it.

[cosmiq]

Thanks for the replies. Didn't know there was a virus database specially for amiga. And apparantly there are a lot of different saddam virusses.
Anyhow, let's see if I can find a decent scanner with which I can solve the issues.

[OddbOd]

Most of the Saddam variants are clones of the original virus with different encryption routines or a different string to overwrite with, the effect and infection method doesn't really vary. Other common features are that Saddam does not infect Non-DOS disks so most games will not be infected and that the virus only runs under Kickstart 1.3 or older.

The SimCity disk you put in The Zone is infected with one of the original Saddam strains as indicated by the string IRAK being written to the start of several files. Any Amiga virus scanner should detect and remove the infected Disk-Validator but the damaged files have been destroyed and cannot be recovered. Some virus scanners will not be able to remove the Disk-Validator because Saddam also damages the disk's bitmap pointer (this is actually the viruses trigger) making it impossible to write anything via the normal AmigaDOS write routine.

Because the virus is so vicious it has only managed to destroy a few files which can easily be replaced, these are:

SimCity512K:C/Setpatch
SimCity512K:C/LoadWB
SimCity512K:Devs/system-configuration
SimCity512K:S/startup-sequence
SimCity512K:Libs/icon.library

To fix this particular disk manually you need to do the following:

1. Validate the disk so that you are able to write to it again, I used FixDisk for this because the standard validator cannot deal with the damaged bitmap pointer.
2. Use FixDisk's Delete Faulty button to kill all the damaged files in the code box above, now delete SimCity512K:L/Disk-Validator which is the virus itself.
3. Copy the files in the code box above plus Disk-Validator from a clean copy of SimCity (or from the Workbench 1.3 disk) on to the damaged disk.
4. If you used a Workbench disk as a source of clean files then you need to edit the startup-sequence so that it reads.
   

   SetPatch >NIL:
   LoadWB
   endcli

[cosmiq]

T.h.a.n.k.s! ALOT for your explanation

Fixdisk will be my everlasting friend
Ill try this tonight. I have a virusscanner somewhere but I think it's very very old. Might worth a try.