cu_1990_12_d008 has a virus?

musashi9 · 14 May 2007, 02:21

I downloaded this cover disk yesterday
cu_1990_12_d008.zip
and when looking at the sine intro at the start of the disk i popped into AR and seen this

pic
it only comes up when you have 512k chip only (no slow)

Galaxy · 01 October 2008, 14:32

Can anyone confirm that this is infected?

If so I'll remove the download.

redblade · 03 October 2008, 03:36

boot block seems clean, only seems to show up when the intro is run? could it be a saddam virus?

I think the "go" file or the intro is a virus.

A quick look under resource seems that the start code copies some memory to the end of chip ram(lost 1k on a 512k system), and plays with Kicktagptr, and Kickchecksum, that type of code doesn't seem normal in a demo.

Mind you I'm not a demo coder, VirusChecker 4.5 didn't pick up anything tho. It seems dodgy.

03 October 2008, 17:26

If my memory serves me correctly, I remember buying a CU Amiga magazine around this time and the cover disk was infected with a virus. They even printed an apology in the mag the next issue (and the funny thing was, I recall them putting a virus killer on the same disk as the virus itself).

Ok, curiosity got the better of me :-)

The issue I'm thinking of is CU Amiga August 1991. The coverdisk has a virus on the bootblock (RevBootLoad according to KDVIII). The virus scanner on the disk itself ironically doesn't detect the presence of a virus, just a non-standard bootblock :-) The September issue has KDVIII on there which detects it.

http://amr.abime.net/issue_73_coverdisks < The label on the Sept coverdisk specifically states "Wipe out the RevBoot virus and many more" :-)

For those of you with big juicy TOSEC collections and want to check it out for yourself, the disk is:

CU Amiga - Disk 016 (1991-08)(EMAP Images)(GB)[a].zip

Ahh good memories of this little fiasco :-)

OddbOd · 04 October 2008, 11:11

Quote:

Originally Posted by Galaxy

Can anyone confirm that this is infected?

Yup, according to Virus Checker II (using the 03.10.1999 brainfile) it appears to be infected with something called Centurions, I took a memory snapshot while the intro was running and found this inside it:

Code:

????????>>>>>>>>>>@HI@THERE;;;@A@NEW@AGE@IN@VIRUS@MAKING@HAS@BEGUN;;;@THANX@TO@US>>>@THANX@TO:@===@CENTURIONS@===@@@AND@WE@HAVE@THE@PLEASURE@TO@INFORM@YOU@THAT@SOME@OF@YOUR@DISKS@ARE@INFECTED@BY@OUR@FIRST@MASTERPIECE@CALLED:@<@THE@SMILY@CANCER@<@@@HAVE@FUN@LOOKING@FOR@IT>>>@AND@STAY@TUNED@FOR@OUR@NEXT@PRODUCTIONS>@@@CENTURIONS:@THE@FUTURE@IS@NEAR;@@@@@@@@@@@@@@@@@@@@@@@......................................................................................................................................................................HELLO HACKERS OUT THERE!! A NEW FORCE HAS BORN IN ITALY:--- CENTURIONS ---. OUR TEAM IS COMPOSED OF 2 GUYZ: ME & HIM.(AHAHHA!) THE AIM OF -- CENTURIONS -- IS JUST VIRUS MAKING.. WE HAVE LOTTA FUN DOING THIS AND WE ALSO HOPE TO GIVE FUN TO THE KILLERS MAKERS (HI STEVE TIBBETT!) HAW! HAW! HAW! SIGNED: ME & HIM / CENTURIONS

kriz · 04 October 2008, 11:13

heheeh

Galaxy · 04 October 2008, 15:05

Ok the download has been removed. Does anyone have a clean copy of this disk?

OddbOd · 04 October 2008, 20:57

If nobody comes to the party with a fresh copy you might want to consider asking one of the experienced coders on here to clean up the existing executable, I have a feeling someone like Codetapper/Photon/Galahad/etc. could do it in their sleep.

Galaxy · 04 October 2008, 23:47

Yeah true, but I would rather post a clean unmodified copy if possible.

redblade · 05 October 2008, 04:03

Yep another viri to add to the collection.

14 May 2007, 02:21	#1
musashi9 Registered User Join Date: Jul 2003 Location: Japan Posts: 98	cu_1990_12_d008 has a virus? I downloaded this cover disk yesterday cu_1990_12_d008.zip and when looking at the sine intro at the start of the disk i popped into AR and seen this pic it only comes up when you have 512k chip only (no slow) __________________ Flashtro

03 October 2008, 03:36	#3
redblade Zone Friend Join Date: Mar 2004 Location: Western Australia Age: 29 Posts: 938	boot block seems clean, only seems to show up when the intro is run? could it be a saddam virus? I think the "go" file or the intro is a virus. A quick look under resource seems that the start code copies some memory to the end of chip ram(lost 1k on a 512k system), and plays with Kicktagptr, and Kickchecksum, that type of code doesn't seem normal in a demo. Mind you I'm not a demo coder, VirusChecker 4.5 didn't pick up anything tho. It seems dodgy. Last edited by redblade; 03 October 2008 at 04:04. Reason: UPdate

04 October 2008, 11:13	#6
kriz Junior Member Join Date: Sep 2001 Location: No(R)Way Age: 31 Posts: 2,201	heheeh __________________ Mac Mini 1,5ghz + powerbook 1,67 ghxz- MorphOS 3.1 -- It rulez !! _ Amiga 4000/060 - Whdload - RDesktop - WookieChat - All Supported. 1200/060/PPC/Indivision - AMIGA 4 EVER

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
T-Zero virus	DDNI	support.Games	11	30 March 2007 04:06
Virus programs	vertigo	support.Apps	12	18 January 2004 12:25
Is SystemZ a virus?	andreas	Retrogaming General Discussion	7	25 November 2002 13:15
Possible Virus on WB	Tonycrew	Retrogaming General Discussion	4	13 June 2002 14:03

01 October 2008, 14:32	#2
Galaxy Registered User Join Date: May 2004 Location: Canberra, Australia Age: 35 Posts: 1,418	Can anyone confirm that this is infected? If so I'll remove the download.

03 October 2008, 17:26	#4
amitrev Posts: n/a	If my memory serves me correctly, I remember buying a CU Amiga magazine around this time and the cover disk was infected with a virus. They even printed an apology in the mag the next issue (and the funny thing was, I recall them putting a virus killer on the same disk as the virus itself). Ok, curiosity got the better of me :-) The issue I'm thinking of is CU Amiga August 1991. The coverdisk has a virus on the bootblock (RevBootLoad according to KDVIII). The virus scanner on the disk itself ironically doesn't detect the presence of a virus, just a non-standard bootblock :-) The September issue has KDVIII on there which detects it. http://amr.abime.net/issue_73_coverdisks < The label on the Sept coverdisk specifically states "Wipe out the RevBoot virus and many more" :-) For those of you with big juicy TOSEC collections and want to check it out for yourself, the disk is: CU Amiga - Disk 016 (1991-08)(EMAP Images)(GB)[a].zip Ahh good memories of this little fiasco :-)

04 October 2008, 15:05	#7
Galaxy Registered User Join Date: May 2004 Location: Canberra, Australia Age: 35 Posts: 1,418	Ok the download has been removed. Does anyone have a clean copy of this disk?

04 October 2008, 20:57	#8
OddbOd Registered User Join Date: Jul 2005 Location: Australia Age: 36 Posts: 623	If nobody comes to the party with a fresh copy you might want to consider asking one of the experienced coders on here to clean up the existing executable, I have a feeling someone like Codetapper/Photon/Galahad/etc. could do it in their sleep.

04 October 2008, 23:47	#9
Galaxy Registered User Join Date: May 2004 Location: Canberra, Australia Age: 35 Posts: 1,418	Yeah true, but I would rather post a clean unmodified copy if possible.

05 October 2008, 04:03	#10
redblade Zone Friend Join Date: Mar 2004 Location: Western Australia Age: 29 Posts: 938	Yep another viri to add to the collection.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)