Joshua 2a Virus - Amiga Virus Encyclopedia

VIRUS HELP TEAM



     ------------------------
     Amiga Virus Encyclopedia
     Joshua 2a Virus
     ------------------------

    
     Name         : Joshua 2

     Aliases      : Switch-Off

     Type         : Bootblock
     
     Size         : 1024 bytes

     Clones       : No Clones 

     Symptoms     : A Sprite will be moved over the screen.

     Discovered   : -
     
     Way to infect: Boot infection

     Rating       : Less Dangerous

     Kickstarts   : 1.2
                    1.3

     Damage       : Overwrites boot

     Removal      : Install boot

     Comments     : If you are booting with a Joshua 1-Virus infected
                    disk the virus allocates some chip-memory and
                    copies itself into this mem.  After that the virus
                    changes the COLD-Vector to stay resident in memory.
                    To infect other disks the virus patches the
                    BeginIO()-Vector from the trackdisk.device (So NO
                    danger for HD-User!). Additionally the virus patches
                    the Vec5-Interrupt -> $94(a6) which moves after a 
                    delay a sprite over the screen. The Sprite looks
                    like this:
                                  ___
                                 |   |
                                 | J |
                                 | O |
                                 | S |
                                 | H |
                                 | U |
                                 | A |
                                 |___|

                    The whole virus is crypted depending of $DFF006.

     Test made by : Safe Hex International
     
     
     Animated picture of the Joshua 2 Virus:
     

     

Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht.dk