# Apple II: DOS 3.3 Virus?

Does anyone know the source of this Apple II DOS 3.3 virus that infected my disks back in the 1990's? I got it from a public domain disk collection that was given to me by a friend, called the Freeloader Library, which was sold commercially in the back of computer magazines in the 1970s-80s.

Video of this Apple II virus in action: https://www.youtube.com/watch?v=rSgqX8ua2F8

There is no identifying information that I can find in the DOS hex code in memory, so I have no clue where this came from.

Method of operation:

• Boot from the viral DOS 3.3
• Insert a disk with some other DOS. Catalog it. Viral DOS checks to see if it is present on this disk. If not, then it overwrites the DOS and installs itself, and does a normal catalog.

Method of attack:

• After typing CATALOG 8 times, it zeroes the current target disk drive and modifies the reset vector so that you cannot break out of the destructive writing. Have to power off (for II/II+) or Control-OpenApple-Reset (IIe/IIc/IIgs) to regain control.

(This is one piece of software that I have no intention of uploading to Apple II disk archives to be preserved for future generations to experience.)

• Sounds like the one I refer to in the "personal note" section of retrocomputing.stackexchange.com/a/284/56 . – fadden Mar 21 '17 at 3:01
• If I were you, I'd upload it to an archive (perhaps in a script-kiddie-proof format), labelling it as malware. It's important to know how malware worked as well as ordinary software; often malware gives one a better understanding of the system than even the best ordinary software. (By the way, I'd be interested to look into this myself!) – wizzwizz4 Mar 21 '17 at 17:21
• Some of the viruses on this page resemble the one you're describing and may help you narrow it down. – snips-n-snails Mar 21 '17 at 21:36
• "Labelling it as malware" can't stress this enough, even though it is for an obsolete system - being careless with malware is one of the most common causes of malware pieces that were only ever intended as lab experiments getting into the wild and causing real world problems... – rackandboneman Aug 22 '17 at 18:56

What you're looking for is called Killer DOS, which behaved exactly like the Unnamed First Virus described on the Apple II History Viruses page. Killer DOS may have been the second version described on that page. I first saw it in the flesh in 1983 or 1984.

There's a reference (although not much of one) to it having been written by a Bill Bach, who may be the founder of Goldstar Software in Illinois. His bio contains material that he would have been doing things with Apples during that era; you might drop him a line and ask.

I can't say I know a great deal about how it was implemented, but it wouldn't have been difficult to JMP out of the CATALOG routine at \$A56E, do your business plus whatever instructions were wiped out by replacing the first few bytes and JMP back into the right place.