Beethoven

Introduction

Beethoven is a virus written for the Commodore Amiga. It is a clone of Bret Hawnes. It is a filevirus.

Summary

• Writes itself to unprotected floppy disks while boot-process
• Stays resident in memory by using KickTagPtr
• Extends the startup-sequence of an inserted disk, writing its filename in the first line
• Has a total length of 2608 bytes
• Alters some operating-system routines:
  • OpenLibrary()-vector of exec.library
  • OpenWindow()-vector of intuition.library
  • $6C (Interrupt-Vector)
• Unlike Bret Hawnes the virus does not destroy disk-blocks

Details

The virus behaves exact like its original Bret Hawnes except that the virus won't destroy disk-blocks and displays an alert¹ instead of a graphical screen.

The text is crypted within the virus, the following routine will be used for decryption…

decrypt:
  lea     data(pc),a1
  move.w  #$400,d0
.loop:
  not.b   (a1)
  eori.b  #$27,(a1)+
  dbf     d0,.loop
  (...)

¹ Well, at least the programmer tried to display an alert but since this routine is totally crap and assumes memorylocations in RangerRam the routine will mostly crash.
Here is the text the virus would display:

0510h: AC 5E 4E 75 69 6E 74 75 69 74 69 6F 6E 2E 6C 69 ; ¬^Nuintuition.li
0520h: 62 72 61 72 79 00 00 00 00 00 00 96 14 48 45 59 ; brary......–.HEY
0530h: 20 21 20 49 43 48 20 42 49 4E 20 5A 55 52 DC 43 ;  ! ICH BIN ZURÜC
0540h: 4B 20 21 21 21 21 21 21 21 21 21 00 01 00 7D 2D ; K !!!!!!!!!...}-
0550h: 2D 3D 3E 20 4C 55 44 57 49 47 20 56 41 4E 20 42 ; -=> LUDWIG VAN B
0560h: 45 45 54 48 4F 56 45 4E 20 3C 3D 2D 00 01 00 AA ; EETHOVEN <=-...ª
0570h: 46 49 43 48 20 4D 41 43 48 45 20 4D 49 43 48 20 ; FICH MACHE MICH 
0580h: 4A 45 54 5A 54 20 41 55 46 20 44 45 4D 20 00 01 ; JETZT AUF DEM ..
0590h: 00 D7 55 41 4D 49 47 41 20 42 52 45 49 54 20 21 ; .×UAMIGA BREIT !
05a0h: 21 21 21 20 00 01 00 96 69 44 41 53 20 48 49 45 ; !!! ...–iDAS HIE
05b0h: 52 20 49 53 54 20 DC 42 52 49 47 45 53 20 4D 45 ; R IST ÜBRIGES ME
05c0h: 49 4E 20 4E 45 55 45 52 20 56 49 52 55 53 00 01 ; IN NEUER VIRUS..
05d0h: 00 96 7D 48 45 20 48 45 20 48 45 20 48 45 20 48 ; .–}HE HE HE HE H
05e0h: 45 20 48 45 20 48 45 2E 2E 2E 2E 20 20 00 01 00 ; E HE HE....  ...
05f0h: 96 87 56 49 45 4C 20 53 50 41 DF 20 4E 4F 43 48 ; –‡VIEL SPAß NOCH
0600h: 2E 2E 2E 20 00 01 00 96 91 50 2E 53 2E 20 4D 45 ; ... ...–‘P.S. ME
0610h: 49 4E 45 20 4D 55 53 49 4B 20 57 41 52 20 53 43 ; INE MUSIK WAR SC
0620h: 48 45 49 DF 45 20 00 01 00 BE A0 2D 20 41 42 45 ; HEIßE ...¾ - ABE
0630h: 52 20 4D 45 49 4E 45 20 56 49 52 45 4E 20 53 49 ; R MEINE VIREN SI
0640h: 4E 44 20 47 45 49 4C 20 21 21 00 01 00 E1 B4 53 ; ND GEIL !!...á´S
0650h: 55 43 4B 20 4D 59 20 44 49 43 4B 20 00 01 00 5A ; UCK MY DICK ...Z
0660h: C3 42 49 54 54 45 20 43 4F 4D 50 55 54 45 52 20 ; ÃBITTE COMPUTER 
0670h: 41 55 53 53 43 48 41 4C 54 45 4E 2E 2E 2E 20 00 ; AUSSCHALTEN... .
0680h: 00 00 00 00 00 00 00 00 00 00 00 00 00 04 3A 40 ; ..............:@

At the beginning of the virus-file you can read the following text:

0000h: 60 00 00 FE 48 41 6C 6C 6F 20 21 20 48 69 65 72 ; `..þHAllo ! Hier
0010h: 20 69 73 74 20 4C 75 64 77 69 67 20 76 61 6E 20 ;  ist Ludwig van 
0020h: 42 65 65 74 68 6F 76 65 6E 20 21 20 00 00 00 00 ; Beethoven ! ....
0030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
0040h: 00 00 00 00 57 69 65 20 67 65 68 74 20 65 73 20 ; ....Wie geht es 
0050h: 65 75 63 68 20 48 61 63 6B 65 72 20 64 61 20 64 ; euch Hacker da d
0060h: 72 61 75 DF 65 6E 20 3F 20 00 00 00 00 00 00 00 ; raußen ? .......
0070h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
0080h: 00 00 00 00 42 69 74 74 65 20 6C 61 DF 74 20 6D ; ....Bitte laßt m
0090h: 69 63 68 20 68 69 65 72 20 21 20 00 00 00 00 00 ; ich hier ! .....
00a0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00b0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00c0h: 00 00 00 00 2D 3D 3E 20 44 45 4E 4E 20 49 43 48 ; ....-=> DENN ICH
00d0h: 20 57 49 4C 4C 20 52 45 49 53 45 4E 20 21 21 20 ;  WILL REISEN !! 
00e0h: 47 65 6E 65 72 61 74 69 6F 6E 20 3A 20 34 35 37 ; Generation : 457
00f0h: 36 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; 6 ..............
0100h: 60 00 00 18 2D 3D 3E 20 42 45 54 48 4F 56 45 4E ; `...-=> BETHOVEN
0110h: 20 3C 3D 2D 2E 2E 2E 2E 2E 2E 2C 79 00 00 00 04 ;  <=-......,y....

For further information please go to Bret Hawnes

Clones and variants

None