Name         : Claas Abraham

     Aliases      : Abraham

     Type/Size    : Boot/1024

     Clones       : No Clones

     Symptoms     : No Symptoms

     Discovered   : 22-10-90

     Way to infect: Boot infection

     Rating       : Dangerous

     Kickstarts   : only 1.2/1.3 with Fastmem.

     Damage       : Overwrites boot + Formats Rootblock of DD-Disk.

     Removal      : Install boot.

     Comments     : If  you are booting with a Claas Abraham infected disk
                    the virus tries to allocate 719 bytes FASTMEM.  If you
                    haven`t  got  FASTMEM  -> GURU! Then changes the COOL,
                    COLD, KICK vectors to stay resident in memory.


                    To  infect other disk the virus patches the BeginIO()-
                    Vector  from the trackdisk.dev. Additionally the virus
                    installs  a new  routine in the Zero-Page ($68).  This
                    patch  sets always the COOL, COLD, KICK vectors to the
                    virus value.


                    Every  boot  block is crypted depending of $DFF006. In
                    the  end  of  the  decrypted  virus  (and  in the Kick
                    Identification string) you can read:


                    ">>> Claas Abraham Virus !!! <<<"


                    If  the  copyvalue  reaches  15  the virus formats the
                    Rootblock of your disk. (only DD-Disks!)


            ADVICE: USE DISKSALV 1 or 2 TO SALVAGE LOST FILES.

A.D 04-94