Name         : Darth Vader

     Aliases      : No Aliases

     Type/Size    : File/784

     Clones       : No Clones

     Symptoms     : No Symptoms

     Discovered   : -

     Way to infect: File infection

     Rating       : Less Dangerous

     Kickstarts   : 1.2/1.3 without Fastmem

     Damage       : Sometimes Startup-Sequence damage.

     Removal      : Delete File.

     Comments     : The  Darth  Vader  virus is very LAME coded. The virus
                    allocates  1100  bytes  memory.  Then it copies itself
                    into  this  address and changes the CoolCapture-Vector
                    to stay resident in memory.


                    To infect other disks the virus patches the OldOpenLib
                    Vector.  If a program  now  uses the OldOpenLib-Vector
                    the does the following:

                    1) Creates  a invisible  file ($A0) in the Root-Dir of
                       the actual disk.

                    2) Then  it  modifies  the  Startup-Sequence  with the
                       virus name.


                       But this routine has a big bug which can damage
                       your startup-squence:

                       - The virus only loads/saves 1000 bytes.
                       - If the Startup-Sequence is longer than 1000
                         bytes, it will be damaged...

                    On  every  5.th  infection  the virus  gives out a CLI
                    Message:

                    "VIRUS (V1.1) BY DARTH VADER"

                    You can also read this text in the file.

A.D 05-94