Home » Archimedes archive » Micro User » MU 1992-03.adf » !VKiller/Docs/CeBitDoc

!VKiller/Docs/CeBitDoc

This website contains an archive of files for the Acorn Electron, BBC Micro, Acorn Archimedes, Commodore 16 and Commodore 64 computers, which Dominic Ford has rescued from his private collection of floppy disks and cassettes.

Some of these files were originally commercial releases in the 1980s and 1990s, but they are now widely available online. I assume that copyright over them is no longer being asserted. If you own the copyright and would like files to be removed, please contact me.

Tape/disk: Home » Archimedes archive » Micro User » MU 1992-03.adf
Filename: !VKiller/Docs/CeBitDoc
Read OK: ✔
File size: 0AF0 bytes
Load address: FFFFFF43
Exec address: 1D6A8E52
Duplicates

There are 9 duplicate copies of this file in the archive:

File contents
This is very detailed (although stopping short of a disassembly of course)
description of the CeBit virus. It is strongly recommended reading, if only to
give you a better understanding of how the virus operates.

CeBit Virus technical information
---------------------------------

This is a module called "TlodMod" with the following title string:

TlodMod 1.11 (11 Nov 1990) by Devil the LORD OF DARKNESS

I'm not sure how it came to be called the "CeBit Virus", but that was the
reference name given to me by Alan Glover of Acorn.

It is 1240 (&4D8) bytes long and hooks itself into UpCallV. It then activates
once a minute and first checks for the existence of <Obey$Dir>.TlodMod. If this
already exists, then no further action is taken. If it doesn't, however, it
then attempts to append the following line to <Obey$Dir>.!Boot:

rme. TlodMod 0 rml. <Obey$Dir>.TlodMod

If it succeeds at this, a counter is incremented and the module is replicated
as <Obey$Dir>.TlodMod. Every 16th successful infection will trip the virus
into issuing a "*Wipe $.path.file*" (which will inevitably fail !) and then
displaying a message accompanied by a simple graphic.

CeBit Virus Infection Count
---------------------------

This is a straight increment (my copy had a count of 110 !), but every time it
hits a multiple of 16, the virus does it nasty work (see above). VKiller will
display the Infection Count if it finds the module in RMA or on disk - the
text message displayed by the virus itself also proclaims the number of
infections too. Here is the text of the message displayed every 16th infection:

This is a warning to all Users,
I am back on the Archimedes ...

Your Archie is infected now and
with him most of your programms.

Don't worry, nothing is damaged,
but keep in mind the protection!

And always think about the other
side of THE LORD OF DARKNESS ...

   Virus generation is <count>

<count> will be the value of the Infection Count. Notice how "programms" is
spelt incorrectly (neither American nor British spelling...).

CeBit Virus Innoculation
------------------------

Sadly, this virus ALWAYS appends the *RMEnsure command to <Obey$Dir>.!Boot,
regardless as to whether it has done so already or not. Hence, the only way
to temporarily innoculate is to set <Obey$Dir> to null:$ in the !Run file of
VKiller. This will only last as long as another application isn't run (which
will reset <Obey$Dir> again) :-(

There is only one (pretty unacceptable) way of permanently innoculating against
the CeBit Virus - a dummy "TlodMod" file could be created in every application
directory. However, this has two disadvantages:

1) Leads to many extra files being created on the disk.
2) Could cause confusion and panic between the "dummy" TlodMod file and the
   "real" TlodMod virus module.

00000000  54 68 69 73 20 69 73 20  76 65 72 79 20 64 65 74  |This is very det|
00000010  61 69 6c 65 64 20 28 61  6c 74 68 6f 75 67 68 20  |ailed (although |
00000020  73 74 6f 70 70 69 6e 67  20 73 68 6f 72 74 20 6f  |stopping short o|
00000030  66 20 61 20 64 69 73 61  73 73 65 6d 62 6c 79 20  |f a disassembly |
00000040  6f 66 20 63 6f 75 72 73  65 29 0a 64 65 73 63 72  |of course).descr|
00000050  69 70 74 69 6f 6e 20 6f  66 20 74 68 65 20 43 65  |iption of the Ce|
00000060  42 69 74 20 76 69 72 75  73 2e 20 49 74 20 69 73  |Bit virus. It is|
00000070  20 73 74 72 6f 6e 67 6c  79 20 72 65 63 6f 6d 6d  | strongly recomm|
00000080  65 6e 64 65 64 20 72 65  61 64 69 6e 67 2c 20 69  |ended reading, i|
00000090  66 20 6f 6e 6c 79 20 74  6f 0a 67 69 76 65 20 79  |f only to.give y|
000000a0  6f 75 20 61 20 62 65 74  74 65 72 20 75 6e 64 65  |ou a better unde|
000000b0  72 73 74 61 6e 64 69 6e  67 20 6f 66 20 68 6f 77  |rstanding of how|
000000c0  20 74 68 65 20 76 69 72  75 73 20 6f 70 65 72 61  | the virus opera|
000000d0  74 65 73 2e 0a 0a 43 65  42 69 74 20 56 69 72 75  |tes...CeBit Viru|
000000e0  73 20 74 65 63 68 6e 69  63 61 6c 20 69 6e 66 6f  |s technical info|
000000f0  72 6d 61 74 69 6f 6e 0a  2d 2d 2d 2d 2d 2d 2d 2d  |rmation.--------|
00000100  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
00000110  2d 2d 2d 2d 2d 2d 2d 2d  2d 0a 0a 54 68 69 73 20  |---------..This |
00000120  69 73 20 61 20 6d 6f 64  75 6c 65 20 63 61 6c 6c  |is a module call|
00000130  65 64 20 22 54 6c 6f 64  4d 6f 64 22 20 77 69 74  |ed "TlodMod" wit|
00000140  68 20 74 68 65 20 66 6f  6c 6c 6f 77 69 6e 67 20  |h the following |
00000150  74 69 74 6c 65 20 73 74  72 69 6e 67 3a 0a 0a 54  |title string:..T|
00000160  6c 6f 64 4d 6f 64 20 31  2e 31 31 20 28 31 31 20  |lodMod 1.11 (11 |
00000170  4e 6f 76 20 31 39 39 30  29 20 62 79 20 44 65 76  |Nov 1990) by Dev|
00000180  69 6c 20 74 68 65 20 4c  4f 52 44 20 4f 46 20 44  |il the LORD OF D|
00000190  41 52 4b 4e 45 53 53 0a  0a 49 27 6d 20 6e 6f 74  |ARKNESS..I'm not|
000001a0  20 73 75 72 65 20 68 6f  77 20 69 74 20 63 61 6d  | sure how it cam|
000001b0  65 20 74 6f 20 62 65 20  63 61 6c 6c 65 64 20 74  |e to be called t|
000001c0  68 65 20 22 43 65 42 69  74 20 56 69 72 75 73 22  |he "CeBit Virus"|
000001d0  2c 20 62 75 74 20 74 68  61 74 20 77 61 73 20 74  |, but that was t|
000001e0  68 65 0a 72 65 66 65 72  65 6e 63 65 20 6e 61 6d  |he.reference nam|
000001f0  65 20 67 69 76 65 6e 20  74 6f 20 6d 65 20 62 79  |e given to me by|
00000200  20 41 6c 61 6e 20 47 6c  6f 76 65 72 20 6f 66 20  | Alan Glover of |
00000210  41 63 6f 72 6e 2e 0a 0a  49 74 20 69 73 20 31 32  |Acorn...It is 12|
00000220  34 30 20 28 26 34 44 38  29 20 62 79 74 65 73 20  |40 (&4D8) bytes |
00000230  6c 6f 6e 67 20 61 6e 64  20 68 6f 6f 6b 73 20 69  |long and hooks i|
00000240  74 73 65 6c 66 20 69 6e  74 6f 20 55 70 43 61 6c  |tself into UpCal|
00000250  6c 56 2e 20 49 74 20 74  68 65 6e 20 61 63 74 69  |lV. It then acti|
00000260  76 61 74 65 73 0a 6f 6e  63 65 20 61 20 6d 69 6e  |vates.once a min|
00000270  75 74 65 20 61 6e 64 20  66 69 72 73 74 20 63 68  |ute and first ch|
00000280  65 63 6b 73 20 66 6f 72  20 74 68 65 20 65 78 69  |ecks for the exi|
00000290  73 74 65 6e 63 65 20 6f  66 20 3c 4f 62 65 79 24  |stence of <Obey$|
000002a0  44 69 72 3e 2e 54 6c 6f  64 4d 6f 64 2e 20 49 66  |Dir>.TlodMod. If|
000002b0  20 74 68 69 73 0a 61 6c  72 65 61 64 79 20 65 78  | this.already ex|
000002c0  69 73 74 73 2c 20 74 68  65 6e 20 6e 6f 20 66 75  |ists, then no fu|
000002d0  72 74 68 65 72 20 61 63  74 69 6f 6e 20 69 73 20  |rther action is |
000002e0  74 61 6b 65 6e 2e 20 49  66 20 69 74 20 64 6f 65  |taken. If it doe|
000002f0  73 6e 27 74 2c 20 68 6f  77 65 76 65 72 2c 20 69  |sn't, however, i|
00000300  74 0a 74 68 65 6e 20 61  74 74 65 6d 70 74 73 20  |t.then attempts |
00000310  74 6f 20 61 70 70 65 6e  64 20 74 68 65 20 66 6f  |to append the fo|
00000320  6c 6c 6f 77 69 6e 67 20  6c 69 6e 65 20 74 6f 20  |llowing line to |
00000330  3c 4f 62 65 79 24 44 69  72 3e 2e 21 42 6f 6f 74  |<Obey$Dir>.!Boot|
00000340  3a 0a 0a 72 6d 65 2e 20  54 6c 6f 64 4d 6f 64 20  |:..rme. TlodMod |
00000350  30 20 72 6d 6c 2e 20 3c  4f 62 65 79 24 44 69 72  |0 rml. <Obey$Dir|
00000360  3e 2e 54 6c 6f 64 4d 6f  64 0a 0a 49 66 20 69 74  |>.TlodMod..If it|
00000370  20 73 75 63 63 65 65 64  73 20 61 74 20 74 68 69  | succeeds at thi|
00000380  73 2c 20 61 20 63 6f 75  6e 74 65 72 20 69 73 20  |s, a counter is |
00000390  69 6e 63 72 65 6d 65 6e  74 65 64 20 61 6e 64 20  |incremented and |
000003a0  74 68 65 20 6d 6f 64 75  6c 65 20 69 73 20 72 65  |the module is re|
000003b0  70 6c 69 63 61 74 65 64  0a 61 73 20 3c 4f 62 65  |plicated.as <Obe|
000003c0  79 24 44 69 72 3e 2e 54  6c 6f 64 4d 6f 64 2e 20  |y$Dir>.TlodMod. |
000003d0  45 76 65 72 79 20 31 36  74 68 20 73 75 63 63 65  |Every 16th succe|
000003e0  73 73 66 75 6c 20 69 6e  66 65 63 74 69 6f 6e 20  |ssful infection |
000003f0  77 69 6c 6c 20 74 72 69  70 20 74 68 65 20 76 69  |will trip the vi|
00000400  72 75 73 0a 69 6e 74 6f  20 69 73 73 75 69 6e 67  |rus.into issuing|
00000410  20 61 20 22 2a 57 69 70  65 20 24 2e 70 61 74 68  | a "*Wipe $.path|
00000420  2e 66 69 6c 65 2a 22 20  28 77 68 69 63 68 20 77  |.file*" (which w|
00000430  69 6c 6c 20 69 6e 65 76  69 74 61 62 6c 79 20 66  |ill inevitably f|
00000440  61 69 6c 20 21 29 20 61  6e 64 20 74 68 65 6e 0a  |ail !) and then.|
00000450  64 69 73 70 6c 61 79 69  6e 67 20 61 20 6d 65 73  |displaying a mes|
00000460  73 61 67 65 20 61 63 63  6f 6d 70 61 6e 69 65 64  |sage accompanied|
00000470  20 62 79 20 61 20 73 69  6d 70 6c 65 20 67 72 61  | by a simple gra|
00000480  70 68 69 63 2e 0a 0a 43  65 42 69 74 20 56 69 72  |phic...CeBit Vir|
00000490  75 73 20 49 6e 66 65 63  74 69 6f 6e 20 43 6f 75  |us Infection Cou|
000004a0  6e 74 0a 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |nt.-------------|
000004b0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 0a 0a  |--------------..|
000004c0  54 68 69 73 20 69 73 20  61 20 73 74 72 61 69 67  |This is a straig|
000004d0  68 74 20 69 6e 63 72 65  6d 65 6e 74 20 28 6d 79  |ht increment (my|
000004e0  20 63 6f 70 79 20 68 61  64 20 61 20 63 6f 75 6e  | copy had a coun|
000004f0  74 20 6f 66 20 31 31 30  20 21 29 2c 20 62 75 74  |t of 110 !), but|
00000500  20 65 76 65 72 79 20 74  69 6d 65 20 69 74 0a 68  | every time it.h|
00000510  69 74 73 20 61 20 6d 75  6c 74 69 70 6c 65 20 6f  |its a multiple o|
00000520  66 20 31 36 2c 20 74 68  65 20 76 69 72 75 73 20  |f 16, the virus |
00000530  64 6f 65 73 20 69 74 20  6e 61 73 74 79 20 77 6f  |does it nasty wo|
00000540  72 6b 20 28 73 65 65 20  61 62 6f 76 65 29 2e 20  |rk (see above). |
00000550  56 4b 69 6c 6c 65 72 20  77 69 6c 6c 0a 64 69 73  |VKiller will.dis|
00000560  70 6c 61 79 20 74 68 65  20 49 6e 66 65 63 74 69  |play the Infecti|
00000570  6f 6e 20 43 6f 75 6e 74  20 69 66 20 69 74 20 66  |on Count if it f|
00000580  69 6e 64 73 20 74 68 65  20 6d 6f 64 75 6c 65 20  |inds the module |
00000590  69 6e 20 52 4d 41 20 6f  72 20 6f 6e 20 64 69 73  |in RMA or on dis|
000005a0  6b 20 2d 20 74 68 65 0a  74 65 78 74 20 6d 65 73  |k - the.text mes|
000005b0  73 61 67 65 20 64 69 73  70 6c 61 79 65 64 20 62  |sage displayed b|
000005c0  79 20 74 68 65 20 76 69  72 75 73 20 69 74 73 65  |y the virus itse|
000005d0  6c 66 20 61 6c 73 6f 20  70 72 6f 63 6c 61 69 6d  |lf also proclaim|
000005e0  73 20 74 68 65 20 6e 75  6d 62 65 72 20 6f 66 0a  |s the number of.|
000005f0  69 6e 66 65 63 74 69 6f  6e 73 20 74 6f 6f 2e 20  |infections too. |
00000600  48 65 72 65 20 69 73 20  74 68 65 20 74 65 78 74  |Here is the text|
00000610  20 6f 66 20 74 68 65 20  6d 65 73 73 61 67 65 20  | of the message |
00000620  64 69 73 70 6c 61 79 65  64 20 65 76 65 72 79 20  |displayed every |
00000630  31 36 74 68 20 69 6e 66  65 63 74 69 6f 6e 3a 0a  |16th infection:.|
00000640  0a 54 68 69 73 20 69 73  20 61 20 77 61 72 6e 69  |.This is a warni|
00000650  6e 67 20 74 6f 20 61 6c  6c 20 55 73 65 72 73 2c  |ng to all Users,|
00000660  0a 49 20 61 6d 20 62 61  63 6b 20 6f 6e 20 74 68  |.I am back on th|
00000670  65 20 41 72 63 68 69 6d  65 64 65 73 20 2e 2e 2e  |e Archimedes ...|
00000680  0a 0a 59 6f 75 72 20 41  72 63 68 69 65 20 69 73  |..Your Archie is|
00000690  20 69 6e 66 65 63 74 65  64 20 6e 6f 77 20 61 6e  | infected now an|
000006a0  64 0a 77 69 74 68 20 68  69 6d 20 6d 6f 73 74 20  |d.with him most |
000006b0  6f 66 20 79 6f 75 72 20  70 72 6f 67 72 61 6d 6d  |of your programm|
000006c0  73 2e 0a 0a 44 6f 6e 27  74 20 77 6f 72 72 79 2c  |s...Don't worry,|
000006d0  20 6e 6f 74 68 69 6e 67  20 69 73 20 64 61 6d 61  | nothing is dama|
000006e0  67 65 64 2c 0a 62 75 74  20 6b 65 65 70 20 69 6e  |ged,.but keep in|
000006f0  20 6d 69 6e 64 20 74 68  65 20 70 72 6f 74 65 63  | mind the protec|
00000700  74 69 6f 6e 21 0a 0a 41  6e 64 20 61 6c 77 61 79  |tion!..And alway|
00000710  73 20 74 68 69 6e 6b 20  61 62 6f 75 74 20 74 68  |s think about th|
00000720  65 20 6f 74 68 65 72 0a  73 69 64 65 20 6f 66 20  |e other.side of |
00000730  54 48 45 20 4c 4f 52 44  20 4f 46 20 44 41 52 4b  |THE LORD OF DARK|
00000740  4e 45 53 53 20 2e 2e 2e  0a 0a 20 20 20 56 69 72  |NESS .....   Vir|
00000750  75 73 20 67 65 6e 65 72  61 74 69 6f 6e 20 69 73  |us generation is|
00000760  20 3c 63 6f 75 6e 74 3e  0a 0a 3c 63 6f 75 6e 74  | <count>..<count|
00000770  3e 20 77 69 6c 6c 20 62  65 20 74 68 65 20 76 61  |> will be the va|
00000780  6c 75 65 20 6f 66 20 74  68 65 20 49 6e 66 65 63  |lue of the Infec|
00000790  74 69 6f 6e 20 43 6f 75  6e 74 2e 20 4e 6f 74 69  |tion Count. Noti|
000007a0  63 65 20 68 6f 77 20 22  70 72 6f 67 72 61 6d 6d  |ce how "programm|
000007b0  73 22 20 69 73 0a 73 70  65 6c 74 20 69 6e 63 6f  |s" is.spelt inco|
000007c0  72 72 65 63 74 6c 79 20  28 6e 65 69 74 68 65 72  |rrectly (neither|
000007d0  20 41 6d 65 72 69 63 61  6e 20 6e 6f 72 20 42 72  | American nor Br|
000007e0  69 74 69 73 68 20 73 70  65 6c 6c 69 6e 67 2e 2e  |itish spelling..|
000007f0  2e 29 2e 0a 0a 43 65 42  69 74 20 56 69 72 75 73  |.)...CeBit Virus|
00000800  20 49 6e 6e 6f 63 75 6c  61 74 69 6f 6e 0a 2d 2d  | Innoculation.--|
00000810  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
00000820  2d 2d 2d 2d 2d 2d 0a 0a  53 61 64 6c 79 2c 20 74  |------..Sadly, t|
00000830  68 69 73 20 76 69 72 75  73 20 41 4c 57 41 59 53  |his virus ALWAYS|
00000840  20 61 70 70 65 6e 64 73  20 74 68 65 20 2a 52 4d  | appends the *RM|
00000850  45 6e 73 75 72 65 20 63  6f 6d 6d 61 6e 64 20 74  |Ensure command t|
00000860  6f 20 3c 4f 62 65 79 24  44 69 72 3e 2e 21 42 6f  |o <Obey$Dir>.!Bo|
00000870  6f 74 2c 0a 72 65 67 61  72 64 6c 65 73 73 20 61  |ot,.regardless a|
00000880  73 20 74 6f 20 77 68 65  74 68 65 72 20 69 74 20  |s to whether it |
00000890  68 61 73 20 64 6f 6e 65  20 73 6f 20 61 6c 72 65  |has done so alre|
000008a0  61 64 79 20 6f 72 20 6e  6f 74 2e 20 48 65 6e 63  |ady or not. Henc|
000008b0  65 2c 20 74 68 65 20 6f  6e 6c 79 20 77 61 79 0a  |e, the only way.|
000008c0  74 6f 20 74 65 6d 70 6f  72 61 72 69 6c 79 20 69  |to temporarily i|
000008d0  6e 6e 6f 63 75 6c 61 74  65 20 69 73 20 74 6f 20  |nnoculate is to |
000008e0  73 65 74 20 3c 4f 62 65  79 24 44 69 72 3e 20 74  |set <Obey$Dir> t|
000008f0  6f 20 6e 75 6c 6c 3a 24  20 69 6e 20 74 68 65 20  |o null:$ in the |
00000900  21 52 75 6e 20 66 69 6c  65 20 6f 66 0a 56 4b 69  |!Run file of.VKi|
00000910  6c 6c 65 72 2e 20 54 68  69 73 20 77 69 6c 6c 20  |ller. This will |
00000920  6f 6e 6c 79 20 6c 61 73  74 20 61 73 20 6c 6f 6e  |only last as lon|
00000930  67 20 61 73 20 61 6e 6f  74 68 65 72 20 61 70 70  |g as another app|
00000940  6c 69 63 61 74 69 6f 6e  20 69 73 6e 27 74 20 72  |lication isn't r|
00000950  75 6e 20 28 77 68 69 63  68 0a 77 69 6c 6c 20 72  |un (which.will r|
00000960  65 73 65 74 20 3c 4f 62  65 79 24 44 69 72 3e 20  |eset <Obey$Dir> |
00000970  61 67 61 69 6e 29 20 3a  2d 28 0a 0a 54 68 65 72  |again) :-(..Ther|
00000980  65 20 69 73 20 6f 6e 6c  79 20 6f 6e 65 20 28 70  |e is only one (p|
00000990  72 65 74 74 79 20 75 6e  61 63 63 65 70 74 61 62  |retty unacceptab|
000009a0  6c 65 29 20 77 61 79 20  6f 66 20 70 65 72 6d 61  |le) way of perma|
000009b0  6e 65 6e 74 6c 79 20 69  6e 6e 6f 63 75 6c 61 74  |nently innoculat|
000009c0  69 6e 67 20 61 67 61 69  6e 73 74 0a 74 68 65 20  |ing against.the |
000009d0  43 65 42 69 74 20 56 69  72 75 73 20 2d 20 61 20  |CeBit Virus - a |
000009e0  64 75 6d 6d 79 20 22 54  6c 6f 64 4d 6f 64 22 20  |dummy "TlodMod" |
000009f0  66 69 6c 65 20 63 6f 75  6c 64 20 62 65 20 63 72  |file could be cr|
00000a00  65 61 74 65 64 20 69 6e  20 65 76 65 72 79 20 61  |eated in every a|
00000a10  70 70 6c 69 63 61 74 69  6f 6e 0a 64 69 72 65 63  |pplication.direc|
00000a20  74 6f 72 79 2e 20 48 6f  77 65 76 65 72 2c 20 74  |tory. However, t|
00000a30  68 69 73 20 68 61 73 20  74 77 6f 20 64 69 73 61  |his has two disa|
00000a40  64 76 61 6e 74 61 67 65  73 3a 0a 0a 31 29 20 4c  |dvantages:..1) L|
00000a50  65 61 64 73 20 74 6f 20  6d 61 6e 79 20 65 78 74  |eads to many ext|
00000a60  72 61 20 66 69 6c 65 73  20 62 65 69 6e 67 20 63  |ra files being c|
00000a70  72 65 61 74 65 64 20 6f  6e 20 74 68 65 20 64 69  |reated on the di|
00000a80  73 6b 2e 0a 32 29 20 43  6f 75 6c 64 20 63 61 75  |sk..2) Could cau|
00000a90  73 65 20 63 6f 6e 66 75  73 69 6f 6e 20 61 6e 64  |se confusion and|
00000aa0  20 70 61 6e 69 63 20 62  65 74 77 65 65 6e 20 74  | panic between t|
00000ab0  68 65 20 22 64 75 6d 6d  79 22 20 54 6c 6f 64 4d  |he "dummy" TlodM|
00000ac0  6f 64 20 66 69 6c 65 20  61 6e 64 20 74 68 65 0a  |od file and the.|
00000ad0  20 20 20 22 72 65 61 6c  22 20 54 6c 6f 64 4d 6f  |   "real" TlodMo|
00000ae0  64 20 76 69 72 75 73 20  6d 6f 64 75 6c 65 2e 0a  |d virus module..|
00000af0

© Dominic Ford 2021–2025.

Our privacy policy is here.
Last updated: 01 May 2025, 21:49 UTC
Website designed by .