Apple ][ worms DO exist!

[fishern3485@cobra.uni.edu]

> I have seen a grand total of
> 
>           *1*
> 
> worms for the Apple ][.  This was a little patch to DOS 3.3 which would
> recopy DOS onto any bootable DOS disk.  The outward manifestation of this
> was that the catalog header ("DISK VOLUME nnn") of the viral operating
> system had been changed to "LEE'S DISC".  This managed to replicate itself
> onto many many disks in my high-school computer lab, but it never infected
> my collection, since I always cold-booted computers from my own (clean)
> disks.  I never did find any other effect of the "Lee's Disc" virus.  I
> did intentionally infect a disk so that I could study it, but I think I
> accidentally updated that disk with Pronto-DOS, so it's gone now.
> 
> Incidentally, the solution to eradicating the above virus is to run MASTER
> CREATE or otherwise copy a clean DOS onto the infected disks.

you're LUCKY.  I've seen *FOUR* and dealt with *1* personally.

Exactly 2 weeks before I got my modem for my //c, the ONLY Apple BBS in
my area crashed and burned.  It was on a GS and got the hard drives
(plural) good.  It was in ProDOS, and I'm told resides in the boot
sector.   Maaaaaajor bummer.

Another I encountered in school VERY similar to the one you ran into.
I saw two strains, the more popular copied DOS 3.3 on any disk I/O
access.  It replaced the slow 3.3 with some form of speeded-up dos
that gave a free sectors report in place of the disk volume = message.
Thanks to a bug, it was not able to damage any disks, but was good for
a major laugh from me.

I noticed several of my disks giving me that free sectors report and
went digging.  Found it the next day and told my comp teacher about
it.  She blamed *me*!  I should have let her play with it by herself,
but I didn't.  Wrote a little program to remove it, and took it to
school.  Cleaned everyone's disk, (ALL were infected) and then this
pompus blond teacher comes up to me and says somthing like "WELL, *I*
could have fixed it too, I have the *master disks* safe in the clothset!"
hahahaha  I asked her to bring them out and of course no write-protect
tabs were present.  Checked them and .....  you guessed it, all infected.
I never laughed soooooo hard.   What a ditz.

The other strain of this one did not give a free sectors report, and there
was NO bugs in it either.  Lost one disk. (looked just like DOS 3.3, except
ran faster)

The other two I found were apparently variations on a theme -- Both were
in ProDOS, and both were nasty.  They resided in the boot block and the
SOS boot block.  One would erase blocks 0-7 after so long, and the other
would randomly corrupt a single bit somewhere in blocks 0-6. (that has
got to be the WORST thing to do to a guy!)  Found them both by
ear.  (you know you're too much into computers when you can HEAR the
disk making an unusual access....)

Someone in my area was a busy bee.


-- 
Nathan Fisher
  FISHERN3485@COBRA.UNI.EDU