Apple II Virii

[shoppa@almach.caltech.edu (Timothy D. Shoppa x4256)]

In article <Cw3I84.6Es@IRO.UMontreal.CA>, guertinp@IRO.UMontreal.CA (Paul Guertin) writes...
>spector@vax2.concordia.ca (Mitchell Spector) writes:
>>	Luckly, there's virtually no thread of viruses in the Apple II world 
>>today, which I see as yet another advantage over using IBMs and Macs.. :-)
> 
>Where can I get information on Apple II viruses? Are then targeted
>at the IIgs only, or are there viruses that will infect ProDOS 8
>and DOS 3.3 disks or files? (I'm especially interested in these,
>since I don't have a IIgs.) What are the standard anti-virus tools
>for each OS? Can I get Apple II virus source or object code somewhere 
>on the net (not very likely, I suppose).
> 
Apple II virii definitely do exist.  The first mention I ever saw
of a computer virus was in Scientific American 10 years ago or so.
It was in, I believe, the "Mathematical Recreations" section, and
had Apple II specific info.  From the information in the column, I wrote
my own little DOS 3.3 virus nearly 10 years ago.

As you probably know, DOS 3.3 resides on the first three tracks of
of the floppy disk.  However, there is a lot of free space in the
third track.  I added some extra code in this space and spliced it
into the RWTS routine.  Whenever RWTS was called on to read track $11
sector $F (the first step in accessing the directory), I had my
new code check to see if the floppy had been already infected, by
checking a certain byte in a certain modified sector somewhere in
the first three tracks.  If
the floppy had not been infected, my new code modified the DOS
3.3 image on the first three tracks so that it was infected.

If you booted from an infected floppy, then replaced it with a
non-infected floppy and did any sort of file or catalog access and
the new floppy was not write protected, the new floppy would get
infected.

In the case of this simple little virus, the way to see if you were
infected was to boot, then do a CATALOG.  If the head went straight
to the directory track ($11), then the disk you booted from wasn't
infected.  However, if the head swept down to one of the first few tracks
to check for infection, then the disk you booted from was infected.
You could check this by watching the head positioner with the cover
removed from a floppy drive, but it was usually much simpler to listen
for the "whoosh-whoosh" as the head stepped in and out.

The cure for infection by my virus was simple: copy the first three
tracks from a non-infected disk to your infected disk.

This is probably the most simple-minded sort of virus you could write.
Chances are that there are many much more complex virii in existence,
that are not so easy to detect.  I wouldn't know the details of these.

Tim. (shoppa@altair.krl.caltech.edu)