-------------------------
     Amiga Virus Encyclopedia
     Butonics v1.31 virus 
     -------------------------


     Name         : Jeff Butonic 1.31

     Aliases      : No Aliases

     Clone        : Aids & Jeff Butonics v4.55

     Type         : File virus
     
     Size         : 3408 bytes

     Symptoms     : Shows an alert

     Discovered   : 15-02-91

     Way to infect: File infection 

     Rating       : Less Dangerous

     Kickstarts   : 1.2/1.3/2.0 BUT: only DD-Disks !!!

     Damage       : No Damage.

     Manifestation: Pretend to be useful cli-command.

     Removal      : Delete file. 

     Comments     : When you are starting the JeffV1.31 virus it
                    first decodes itself with a eor-loop. After
                    that it tries to allocate 3500 bytes memory,
                    makes itself resident by changing the kick-vectors,
                    installs a patch in $6c.s (Zero-Page!) and
                    finally patches the DoIO()-Vector from EXEC.LIB.
                    The DoIO()-Vector is used to infect other disks.
                    If you are inserting an unprotected disk, the
                    virus scans the root-block of it ($6E000 = only
                    DD-Disks!!!) and tries to create the virusfile
                    and to modifiy the startup-sequence. No DOS-functions
                    , like Open(), write() and so on
                    are used (!!). The virus creates the virusfile
                    with different names:
                    
                    "AddBuffers 20"
                    "Add21K" 
                    "Fault 206"
                    "break 1 D"
                    "changetaskpri 5"
                    "wait"    
                    "Arthus"
                    "Helmar" 
                    "Aloisius"

                    Sometimes the widow-title changes and following
                    messages will appear:
 
                    Ich brauch jetzt'n Bier!
                    Stau auf Datenbus bei Speicherkilometer 128!
                    mehr Buszyklen für den Prozessor!
                    Ein dreifach MITLEID für Atari ST!
                    BUTONIC!
                    Schon die Steinzeitmenschen benutzten MS-DOS...
                    einige sogar heut noch!
                    Schon mal den Sound vom PS/2 gehört???
                    PC/XT-AT: Spendenkonto 004...
                    Unabhängigkeit & Selbstbestimmung für den Tastaturprozessor!

                    Depending of $DFF006 , the virus gives out the 
                    following alert:

                                 Einen ganz wunderschönen guten Tag!
                        * I am JEFF - the new Virus generation on Amiga *
                                    (w) by the genious BUTONIC.
                            V 1.31/05.11.88 - Generation Nr.00053
                    Greetings to * Hackmack *,* Atlantic *, Wolfram, Frank,
                    Miguel, Alex, Gerlach, and to the whole Physik-LK from MPG !!

     Antivirus   : Kickstart 1.2 & 1.3..... : VT-Schutz
                   Kickstart 2.0 and higher : VirusZ III, with the new Xvs.library installed
 

     

☣

Virus Help Team Denmark & Canada Copyright © All Rights Reserved

☣