17

Does anyone know the source of this Apple II DOS 3.3 virus that infected my disks back in the 1990's? I got it from a public domain disk collection that was given to me by a friend, called the Freeloader Library, which was sold commercially in the back of computer magazines in the 1970s-80s.

Video of this Apple II virus in action: https://www.youtube.com/watch?v=rSgqX8ua2F8

There is no identifying information that I can find in the DOS hex code in memory, so I have no clue where this came from.

Method of operation:

  • Boot from the viral DOS 3.3
  • Insert a disk with some other DOS. Catalog it. Viral DOS checks to see if it is present on this disk. If not, then it overwrites the DOS and installs itself, and does a normal catalog.

Method of attack:

  • After typing CATALOG 8 times, it zeroes the current target disk drive and modifies the reset vector so that you cannot break out of the destructive writing. Have to power off (for II/II+) or Control-OpenApple-Reset (IIe/IIc/IIgs) to regain control.

(This is one piece of software that I have no intention of uploading to Apple II disk archives to be preserved for future generations to experience.)

Improve this question
5
  • 1
    Sounds like the one I refer to in the "personal note" section of retrocomputing.stackexchange.com/a/284/56 .
    – fadden
    Commented Mar 21, 2017 at 3:01
  • 6
    If I were you, I'd upload it to an archive (perhaps in a script-kiddie-proof format), labelling it as malware. It's important to know how malware worked as well as ordinary software; often malware gives one a better understanding of the system than even the best ordinary software. (By the way, I'd be interested to look into this myself!)
    – wizzwizz4 ♦
    Commented Mar 21, 2017 at 17:21
  • 1
    Some of the viruses on this page resemble the one you're describing and may help you narrow it down.
    – snips-n-snails
    Commented Mar 21, 2017 at 21:36
  • 2
    "Labelling it as malware" can't stress this enough, even though it is for an obsolete system - being careless with malware is one of the most common causes of malware pieces that were only ever intended as lab experiments getting into the wild and causing real world problems...
    – rackandboneman
    Commented Aug 22, 2017 at 18:56
  • 2
    Just labeling it as malware is not enough: you should certainly upload it in a format that is non-trivial to turn in to an executable. (Don't worry about the difficulty of transforming it back; anybody competent to research it in running form will have no problem with it.) It's probably best to consult an archivist or researcher for the best way to handle this (particularly before you upload it to a publicly-accessible repository), but one example might be to distribute it as a hex- and ASCII-dump text file, which wouldn't even need to be converted to binary form for some research.
    – cjs
    Commented Apr 13, 2020 at 8:55

3 Answers 3

Reset to default
13

What you're looking for is called Killer DOS, which behaved exactly like the Unnamed First Virus described on the Apple II History Viruses page. Killer DOS may have been the second version described on that page. I first saw it in the flesh in 1983 or 1984.

There's a reference (although not much of one) to it having been written by a Bill Bach, who may be the founder of Goldstar Software in Illinois. His bio contains material that he would have been doing things with Apples during that era; you might drop him a line and ask.

I can't say I know a great deal about how it was implemented, but it wouldn't have been difficult to JMP out of the CATALOG routine at $A56E, do your business plus whatever instructions were wiped out by replacing the first few bytes and JMP back into the right place.

Improve this answer
17

I am one of the two authors of Killer DOS. If you know the final lock screen when your disk was corrupted, we took credit as "The Master" and "The Wizard". I was the DOS Master. We were high school students at the time in a Chicago suburb and wrote the virus in a single weekend. Killer DOS was done as a challenge by a friend at another high school to one-up the previous "catalog" virus that started in a different suburb/school system closer in to Chicago. That virus just ran the "init" routine if you typed catalog taking 3 minutes to cause full damage with no replication. For Killer DOS, we made it replicate itself on any access to the VTOC (volume table of contents), an internal call used for any access to any files or a catalog. It set up a count down timer of 50 to give it time to replicate to others (of course many things decremented the counter, usually took 1-3 days). Once down to 0, we manually controlled the drive head, seeked track 0, and dragged the write head across the entire disk in less than 2.5 seconds. The disk could be reinitialized, but all data would be lost.

Improve this answer
9
  • 2
    How did it get into the wild? (Also, do you still have a copy?)
    – wizzwizz4 ♦
    Commented Aug 22, 2017 at 19:30
  • 4
    I kept all of my old disks (700+) plus my Apple II+ and all the special hardware I had, so I should have a copy, but honestly I haven't booted the machine in 20 years. I recently moved and saw it all again and brought back memories. I even found my "Beneath Apple DOS" book, which I considered the "bible" for Apple DOS and was the beginning for me to get super engaged with it. It gave you most of the entry points in the operating system and you just did trial and error to learn from there.
    – Apple II DOS Master
    Commented Aug 22, 2017 at 21:27
  • 7
    As far as how it got into the wild... my high school was quite advanced for 1981, offering 6 different computer classes including Machine Language, for which I was in the first class to take it. We had a computer lab with 20 Apple IIs including 10 "networked" to a 20MB Corvis hard drive (a really big deal back then when disks where 130K). Long story short, I had a real a-hole of a teacher (long story) that wouldn't let me alone, so I left it on ONE machine ONE time and it spread like crazy...
    – Apple II DOS Master
    Commented Aug 22, 2017 at 21:31
  • 7
    It was on a lot of students disks and the first one actually crashed the first day! It was at the community college and 4 local schools within a week. I saw it on bulletin boards in California within 10 days. It didn't spread super fast because I put out an overwrite patch application that would fix any disk (actually replacing it with another DOS I made that had secret commands and other fun stuff, but was benign).
    – Apple II DOS Master
    Commented Aug 22, 2017 at 21:33
  • 7
    Of course, the teachers didn't trust that the overwrite patch was benign so my school wouldn't use it, but all my friends did. I was big in the game trading areas on several bulletin boards and could get the word out. My favorite pass time was actually unprotecting "protected" games by doing the boot traces and capturing the programs. It was a real chess/cat and mouse game that was a lot of fun.
    – Apple II DOS Master
    Commented Aug 22, 2017 at 21:36
0

Holy Blast from the Apple Past! The virus you have in the Youtube video looks similar to Killer DOS that I had seen in the 80's in the way that it would infect disks, however, the one in your video is much much less amazing than the true Killer DOS that I witnessed during the same timeframe. The Killer DOS that I witnessed had an amazing kill screen. It blanked out the screen and had white borders everywhere with flashing inversed text space bars and it said "You are a victim of Killer DOS!!! Everything on this disk has been degaussed!" directly in the center of the screen and it was flashing text.

But the most amazing thing about it was as the kill screen was being displayed, it played the most eeriest and freakiest sound that the Apple IIe was capable of at the time. It was so good, I have digitized it and I may be able to dig it up. Also, at one point in time, I was so fascinated in the sound from the kill screen that I was able to export just the sound routine in assembly language and I could run the sound routine in DOS. Some other things I remember about it. As the other person mentioned on the Apple site 20 years ago, it did come on a speech synthesized disk containing several other programs and it said "You have chosen Killer DOS Editor" when you selected the Editor. Killer DOS Editor was created or partly created by or distributed by Die Katze (German for The Cat). From what I remember, the editor allowed you to change the number of DOS commands that needed to be issued before the kill screen would commence. But it was so long ago I don't remember all the details of the editor. I believe it also let you infect a disk that was not previously infected.

Now it could have been the exact same version of Killer DOS and maybe somebody just figured out how to add the amazing kill screen and sound routine to it. Either way, it was pretty amazing and it's unfortunate that you were not able to see the full kill screen in all its glory. You would have been amazed. Anyway, does anyone here remember a user named Die Katze by any chance? That person would be able to fill in many more details about this lost piece of software. Also, has anyone else besides myself seen the version of Killer DOS that I am referring to with the amazing kill screen and sound?

Apple II DOS Master, does what I have described sound like your version of Killer DOS, or was yours different? I seem to remember a reference to The Master and The Wizard but I don't recall 100% if it was from the kill screen or from Apple Warez of the time.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .