16

Does anyone know the source of this Apple II DOS 3.3 virus that infected my disks back in the 1990's? I got it from a public domain disk collection that was given to me by a friend, called the Freeloader Library, which was sold commercially in the back of computer magazines in the 1970s-80s.

Video of this Apple II virus in action: https://www.youtube.com/watch?v=rSgqX8ua2F8

There is no identifying information that I can find in the DOS hex code in memory, so I have no clue where this came from.

Method of operation:

  • Boot from the viral DOS 3.3
  • Insert a disk with some other DOS. Catalog it. Viral DOS checks to see if it is present on this disk. If not, then it overwrites the DOS and installs itself, and does a normal catalog.

Method of attack:

  • After typing CATALOG 8 times, it zeroes the current target disk drive and modifies the reset vector so that you cannot break out of the destructive writing. Have to power off (for II/II+) or Control-OpenApple-Reset (IIe/IIc/IIgs) to regain control.

(This is one piece of software that I have no intention of uploading to Apple II disk archives to be preserved for future generations to experience.)

| improve this question | |
  • 1
    Sounds like the one I refer to in the "personal note" section of retrocomputing.stackexchange.com/a/284/56 . – fadden Mar 21 '17 at 3:01
  • 5
    If I were you, I'd upload it to an archive (perhaps in a script-kiddie-proof format), labelling it as malware. It's important to know how malware worked as well as ordinary software; often malware gives one a better understanding of the system than even the best ordinary software. (By the way, I'd be interested to look into this myself!) – wizzwizz4♦ Mar 21 '17 at 17:21
  • 1
    Some of the viruses on this page resemble the one you're describing and may help you narrow it down. – snips-n-snails Mar 21 '17 at 21:36
  • 1
    "Labelling it as malware" can't stress this enough, even though it is for an obsolete system - being careless with malware is one of the most common causes of malware pieces that were only ever intended as lab experiments getting into the wild and causing real world problems... – rackandboneman Aug 22 '17 at 18:56
  • Just labeling it as malware is not enough: you should certainly upload it in a format that is non-trivial to turn in to an executable. (Don't worry about the difficulty of transforming it back; anybody competent to research it in running form will have no problem with it.) It's probably best to consult an archivist or researcher for the best way to handle this (particularly before you upload it to a publicly-accessible repository), but one example might be to distribute it as a hex- and ASCII-dump text file, which wouldn't even need to be converted to binary form for some research. – cjs Apr 13 at 8:55
10

What you're looking for is called Killer DOS, which behaved exactly like the Unnamed First Virus described on the Apple II History Viruses page. Killer DOS may have been the second version described on that page. I first saw it in the flesh in 1983 or 1984.

There's a reference (although not much of one) to it having been written by a Bill Bach, who may be the founder of Goldstar Software in Illinois. His bio contains material that he would have been doing things with Apples during that era; you might drop him a line and ask.

I can't say I know a great deal about how it was implemented, but it wouldn't have been difficult to JMP out of the CATALOG routine at $A56E, do your business plus whatever instructions were wiped out by replacing the first few bytes and JMP back into the right place.

| improve this answer | |
13

I am one of the two authors of Killer DOS. If you know the final lock screen when your disk was corrupted, we took credit as "The Master" and "The Wizard". I was the DOS Master. We were high school students at the time in a Chicago suburb and wrote the virus in a single weekend. Killer DOS was done as a challenge by a friend at another high school to one-up the previous "catalog" virus that started in a different suburb/school system closer in to Chicago. That virus just ran the "init" routine if you typed catalog taking 3 minutes to cause full damage with no replication. For Killer DOS, we made it replicate itself on any access to the VTOC (volume table of contents), an internal call used for any access to any files or a catalog. It set up a count down timer of 50 to give it time to replicate to others (of course many things decremented the counter, usually took 1-3 days). Once down to 0, we manually controlled the drive head, seeked track 0, and dragged the write head across the entire disk in less than 2.5 seconds. The disk could be reinitialized, but all data would be lost.

| improve this answer | |
  • 2
    How did it get into the wild? (Also, do you still have a copy?) – wizzwizz4♦ Aug 22 '17 at 19:30
  • 4
    I kept all of my old disks (700+) plus my Apple II+ and all the special hardware I had, so I should have a copy, but honestly I haven't booted the machine in 20 years. I recently moved and saw it all again and brought back memories. I even found my "Beneath Apple DOS" book, which I considered the "bible" for Apple DOS and was the beginning for me to get super engaged with it. It gave you most of the entry points in the operating system and you just did trial and error to learn from there. – Apple II DOS Master Aug 22 '17 at 21:27
  • 5
    As far as how it got into the wild... my high school was quite advanced for 1981, offering 6 different computer classes including Machine Language, for which I was in the first class to take it. We had a computer lab with 20 Apple IIs including 10 "networked" to a 20MB Corvis hard drive (a really big deal back then when disks where 130K). Long story short, I had a real a-hole of a teacher (long story) that wouldn't let me alone, so I left it on ONE machine ONE time and it spread like crazy... – Apple II DOS Master Aug 22 '17 at 21:31
  • 5
    It was on a lot of students disks and the first one actually crashed the first day! It was at the community college and 4 local schools within a week. I saw it on bulletin boards in California within 10 days. It didn't spread super fast because I put out an overwrite patch application that would fix any disk (actually replacing it with another DOS I made that had secret commands and other fun stuff, but was benign). – Apple II DOS Master Aug 22 '17 at 21:33
  • 5
    Of course, the teachers didn't trust that the overwrite patch was benign so my school wouldn't use it, but all my friends did. I was big in the game trading areas on several bulletin boards and could get the word out. My favorite pass time was actually unprotecting "protected" games by doing the boot traces and capturing the programs. It was a real chess/cat and mouse game that was a lot of fun. – Apple II DOS Master Aug 22 '17 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.