Re: NinjaForce, LodeRunner, and Viruses

[nparker@cie-2.uoregon.edu (Neil Parker)]

In article <tolsenCxxyD6.D5F@netcom.com> tolsen@netcom.com (Tall Runner) writes:
>: Never heard of the Blackout virus. What was its specialty/mode of operation?
>From what I understand, the Blackout virus was harmless...just annoying.  
>All it did was reset your GS's control panel to black text, black 
>background, and black border.  It also set the Control panel slot 
>settings to "non-standard" settings so your drives wouldn't boot.  There 
>was a way to defeat this. Take the battery out of the GS and all the control 
>panel settings would revert back to default.

I never got infected by Blackout, but I seem to recall from the discussion at
the time that clipping out the battery to restore the system is a bit like
hunting gnats with a machine gun.  It should be sufficient to press control-
option-reset (or hold down the option key when you turn on the computer), and
then press "2" (or "3" if you live in a country that uses 50-Hz power).  This
restores all the control panel settings to their defaults.
>
>: I've got a copy of a disabled version of the Load Runner virus around 
>: here somewhere. If people are interested, I'll place it in the binaries.
>
>I'd be interested in looking at this.  Not that I want to write a virus 
>or anything :)  What did Load Runner do???

Please don't post the virus.  That would be an open invitation to some
immature little munchkin to insert a live copy into some program and post
the infected program to comp.binaries.apple2...

Anyway, Load Runner lives in blocks 0 and 1 of a 3.5-inch disk.  When you
boot an infected disk, it loads itself into memory, disguises itself as
part of the RAMdisk (so it can survive control-apple-reset), and hooks
itself into the Memory Manager.  The next time you press
control-apple-reset, the Memory Manager hook wakes up, and the virus copies
itself to blocks 0 and 1 of the disk in slot 5, drive 1.

It also watches the system clock.  If the clock says the month is
September, it sometimes (but not always) alters the screen border color.
If the clock says the month is October, November, or December, it writes
zeros to blocks 0 and 1 of the disk in slot 5, drive 1, rendering the disk
unbootable, and displays loud flashy messages on the screen.

               - Neil Parker
--
     Neil Parker *** nparker@cie-2.uoregon.edu *** nparker@cie.uoregon.edu
                     "Ooh!  Bad move, Neil!"  -- The Tick