------------------------
     Amiga Virus Encyclopedia
     Joshua 2a Virus
     ------------------------

    
     Name         : Joshua 2

     Aliases      : Switch-Off

     Type         : Bootblock
     
     Size         : 1024 bytes

     Clones       : No Clones 

     Symptoms     : A Sprite will be moved over the screen.

     Discovered   : -
     
     Way to infect: Boot infection

     Rating       : Less Dangerous

     Kickstarts   : 1.2
                    1.3

     Damage       : Overwrites boot

     Removal      : Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                    Kickstart all others: VirusZ III v1.04ß or higher, and also Xvs.library v33.47 or higher

     Comments     : If you are  booting  with a Joshua 1-Virus infected
                    disk  the  virus  allocates  some  chip-memory  and
                    copies it self into this mem.  After that the virus
                    changes the COLD-Vector to stay resident in memory.
                    To   infect  other  disks  the  virus  patches  the
                    BeginIO()-Vector  from  the trackdisk.device (So NO
                    danger for HD-User). Additionally the virus patches
                    the Vec5-Interrupt -> $94(a6) which  moves  after a 
                    delay  a  sprite  over the screen. The Sprite looks
                    like this:
                                  ___
                                 |   |
                                 | J |
                                 | O |
                                 | S |
                                 | H |
                                 | U |
                                 | A |
                                 |___|

                    The whole virus is crypted depending of $DFF006.

     Test made by : Safe Hex International
     
     
     Animated picture of the Joshua 2 Virus: