Some Sense and Nonsense about Viruses
PART I
THE ULTIMATE VIRUS KILLER BOOK
5 - SOME SENSE AND NONSENSE ABOUT VIRUSES
Ever since the computer virus phenomenon first appeared, it has
been covered by all computer magazines in just about every
civilised country (and probably a few others, too <grin>).
Unfortunately, however, the resulting abundance of words only
seems to have succeeded in misinforming the users, or at least in
not informing them sufficiently or just confusing them.
In this chapter, the most common occurrences of non-sense will
be cleared.
5.1 THE WRITE-PROTECT PROBLEM
In the early months when viruses started popping up, there was
little certainty with regard to the question whether or not
viruses could write themselves onto the bootsectors of disks that
were write-protected (with 3.5" disks this means that you can
look through the WP-notch; with 5.25" this means that there is an
adhesive placed over the WP-notch). Obviously, it should be
impossible to write on write-protected disks, but there were
people that assumed that, if viruses addressed the hardware
directly (without interference of the Operating System), they
would actually be able to write on write-protected disks. This
was a somewhat startling theory, as it would effectively disable
the safest known method of protection against viruses if it were
true.
I was among those who didn't take the write-protect function's
safety for granted. Heavens were almost literally torn asunder
and the earth was shaken thoroughly. In the end some of the
people at the hardware department of Atari Corporation, disk
drive specialists and people at Western Digital (the people that
designed the Atari's Floppy Disk Controller) were contacted.
Their answer was unanimous and certain: On any Atari TOS system
with a functioning write-protect mechanism it is absolutely
impossible to write on a disk when it is write-protected!
Checking whether your disk drive's write-protect mechanism
functions properly is an easy task; simply write-protect a disk
and then copy a file to it. If you get a "disk is write-
protected" error message, it works like it should and you're
quite, quite safe.
5.2 THE ROM-WRITE PROBLEM
For those of you who may not know: ROM is an acronym for Read
Only Memory. It's the type of memory that you cannot write to
(hence its name, read only) and that is non-volatile (meaning it
will not lose its contents when a computer's power is switched
off). In Atari TOS computers, like in most systems, ROM memory is
used to store the Operating System, TOS. ROM cannot be altered in
any way. Despite that basic fact, a highly reputable computer
shop once claimed that a computer had to be repaired because, and
I quote, "a computer virus had written itself into ROM".
In short: This is utter nonsense. Cod's wallop. Drivel. A cheap
excuse for that shop to cash in on computer diagnostics and
repair fees.
Rather longer: In order to be able 'to write to ROM' you
actually need to have your Operating System present on EPROMs
(Erasable Programmable ROMs) and you need a special device called
an EPROM Programmer (or Prommer in rather more geeky language), a
piece of hardware that can write to EPROMs. If you open up your
computer, indeed, there are chances you will find your Operating
System stored on EPROMs. You may find dust, bits of beernuts and
various other items of debris that really oughtn't be there, but
you certainly won't find an EPROM programmer there. And even if
you did, you'd also need an EPROM Eraser to be able to clear the
EPROMs before they can effectively be written to.
Please rest safe in the knowledge that a whole lot of wholly
unlikely things are more likely to happen than your computer
turning out to have an EPROM Programmer (and EPROM Eraser) built
in. Winning the lottery for 42 years running, for example; the
world spontaneously falling in love with Saddam Hussayn; washing
powder commercials actually not misleading the consumer; Terry
Pratchett annihilating the world's entire Orang Utan population.
"Power Without the Price" would be an impossibility if Atari had
built in all that useless stuff. As a matter of fact there is
only one computer in the world that has an EPROM Programmer built
in: The rather eccentric portable Cambridge Computer Z88, which
uses EPROM cartridges as mass storage media.
An interesting fact to add, in this context, is that a German
magazine called "Happy Computer" published an article about what
they called Hard Viruses in April 1987. These were viruses, they
claimed, that simulated an EPROM programmer, thus enabling the
utter destruction of your computer.
A virus killer program was supplied in the same issue. It wasn't
a source listing but one of those seemingly endless collections
of hexadecimal figures that would require a whole day to be typed
in meticulously, and then a few extra days to find out which
figures you typed in wrongly. They claimed it was the only thing
with the ability to save you from those extremely dangerous Hard
Viruses. Once this alleged virus killer was completely typed in
and the program file ready to run, people just got a text on the
screen along the lines of "You fell for an April Fool's Joke, so
now laugh about it."
Especially German magazines, and also the English ones of late,
often publish really ridiculous things in their April issues. So
be warned. Do not be fooled by stuff about really strange
viruses, or cheap DIY Virtual Reality Devices on a pair of
glasses or something other along those lines...
5.3 THE BATTERY BACKED RAM PROBLEM
So if viruses cannot write themselves to ROM, they will probably
write themselves to RAM, won't they? Right. We already know they
do. What was to happen if there was a bit of computer RAM that
would not lose its contents upon the computer being turned off, a
so-called bit of Non-Volatile RAM? Could a virus get in there and
be preserved even if power were turned off?
The answer to this is really simple, and it is "principally
yes". But don't panic just yet.
Some of you may know that certain types of Atari TOS computers
have a small part of RAM memory, so-called Non-Volatile RAM (or
NVRAM in short), that keeps track of the system date and time
while it's switched off and also makes sure certain configuration
parameters are preserved. The computers that have that are the
MEGA ST, MEGA STE, TT and Falcon. In the Falcon it is powered by
an internal capacitor that is recharged every time your computer
is switched on. In the other systems it is powered by two AA-type
batteries that are located in a battery compartment somewhere in
their housing.
The NVRAM of these computers is located in their keyboard
processor, which is a chip that handles the keyboard and mouse as
well as the system's date and time. These keyboard processors are
the equivalent of the chips that used to be the main processors
in computers like the Commodore 64 and Atari XL. They have their
own tiny little Operating System on a bit of ROM and, indeed,
they have about 128 bytes of RAM. That RAM is used to store the
date and time in and to keep track of joystick and mouse
movements. On the Falcon it also contains information on certain
configuration parameters such as the keyboard layout (language),
date format, Operating System language, boot-up resolution and
some other such things. But even if this bit of RAM were
completely empty and never used for anything, it would not even
suffice to store two lines of this book's text.
The smallest known virus on the Atari platform, the Tiny Virus,
which only copies itself and never does anything bad as it has
sacrificed all destruction routines in favour of being very
compact, still occupies about 170 bytes of contiguous space. It
can therefore be safely assumed that no virus will ever be able
to make decent use of what limited NVRAM there is in certain
Atari computer types.
5.4 THE "AREN'T VIRUSES OUT OF FASHION NOW?" PROBLEM
Viruses have never been out of fashion and never will be until
manufacturers design a system that is virus-proof. Since most
manufacturers seem blissfully unaware of the virus problem in the
first place - at least to outward appearances so as not to scare
off potential customers - the thought of a virus-proof computer
seems almost fanciful.
Literally every computer on the market suffers from viruses, and
it's sufficient for one person not to kill them regularly to
start a virus epidemic all over again. And even as we speak there
are new viruses roaming around that are still not recognised
properly by any virus killers, including some on our own Atari
system.
The only good thing about viruses, actually, is that the people
who get some kind of weird kick out of making them might some day
be struck by viruses themselves. Viruses don't discriminate and
couldn't care any less about whose system they crash or whose
data they send into data's equivalent of the Eternal Buffalo
Hunting Grounds.
5.5 THE "OOPS, I FORGOT TO WRITE SOMETHING, TOO!" PROBLEM
When viruses first appeared on personal computers, computer
magazines were falling over each other to write more spectacular
revelations. Sometimes it really seemed as if tabloid strategies
were being employed, as if sales were more important than a
somewhat more sober but accurate coverage of the topic. When a
hot new game is released all magazines try to be first with a
full-page review with screenshots aplenty and catchy test
conclusions; when the virus problem first occurred all magazines
tried to be the first with in-depth full-page articles with
frightening statements galore and scary new conclusions.
There is not one computer magazine, possibly with the exclusion
of a few that were dedicated solely to games, that hasn't covered
the virus problem. The fact that they did not always write too
objectively - and that their authors were not always as capable
as perhaps they should have - accounts for most of the bits of
nonsense that this chapter tries to dispel.
And so it happened that in one magazine it could be read that
"the virus problem is only very minor and there is no reason to
give any attention to it" whereas in another magazine stories
could be read involving "utter destruction"; in one magazine it
could be read that "viruses were merely a figment of virus killer
programmers' imaginations, people who were of doubtful ethics
anyway for asking money for their services" and in another there
was mention of "infected disks that needed to be physically
thrown away no matter what was on them". All of this could be
read, quite literally, in the computer press over the last seven
years or so.
All modesty aside, I think I can be as bold as to assume that
this book contains facts only, not fiction. I have been involved
with the virus problem on the Atari platform for almost eight
years. I know of what I speak.
But be gone with immodesty now. I must learn to have a better
grip on myself sometimes.
>WHACK!<
5.6 THE PANIC! PROBLEM
It is quite logical that people panic when they hear of viruses
appearing on their computer system, most particularly if they
don't have a clue as to what to do about it. Whenever something
odd happens to them it gets blamed on viruses. They generally
don't know what viruses do, nor do they know what might have
caused their problems otherwise, so the step to explaining things
through virus infection is an easy one. Whenever a program 'bombs
out' or generally does not function like it should: A virus!
Whenever a 'write/read error' appears on the disk: A virus!
Whenever one has to push the reset button to leave the system
because it seems to have locked up: A virus! Whenever the mouse
moves a bit awkward: A virus! Whenever a "disk may be damaged
error" occurs: A virus!
It is easily imagined that all of this does not particularly
help to create an objective atmosphere around the virus problem.
People that did not really know much about viruses have even been
known to advise others to physically destroy their infected disks
(no matter if they happened to contain the working source files
of half a year's programming, or data files containing 2932
business associate's addresses)! There are many more examples of
ridiculousness like this, which shall not be mentioned here. Just
thoroughly realise that, when you read an article about viruses
somewhere, not everybody knows what they are talking about when
viruses are concerned. The golden rule in all cases is, as could
be learned from Douglas Adams' "Hitchhiker's Guide to the
Galaxy": DON'T PANIC!
Below you will find some common examples of what can happen when
people panic, or when people ascribe certain seemingly
inexplicable happenings to viruses.
5.6.1 THE FLAIR PAINT VIRUS
For a long time, a tale went round that spoke of a mysterious
virus, probably a very dangerous kind of link virus, embedded in
the Eigen Software drawing package "Flair Paint". I was, of
course, totally baffled not to find a single suspect byte in any
of the many files on the disk once I could actually examine it. I
immediately set out to get to the source of this rumour.
Luckily enough, Eigen Software's Jeff Lawson was happy to
oblige. He told me he had, a long time ago, written an article in
an English weekly computer magazine about some viruses that had
accidentally been spread on approximately 20 copies of "Flair
Paint" that he had sold on a computer show. It concerned a
bootsector virus here, and from what Jeff told me it was probably
the virus that is now most commonly known as the Signum Virus.
Whereas previously I had somehow gotten it into my head that
every single copy of "Flair Paint" had had a lethal link virus
embedded in it, it turned out to have been a virtually harmless
bootsector virus spread on a mere 20 copies. That is when you
learn never to rely on rumours of any kind, especially not word
of mouth. People have a tendency to make things much worse than
they are because, well, it makes it - and them - sound more
interesting.
5.6.2 THE MOON VIRUS
Strange occurrences of strange events are often believed to be
caused by viruses. Most of the time, reality can not even be
guessed at, let alone be explained by small and complex but
nonetheless severely limited things like computer viruses. One
day in spring 1990, for example, I received a disk from a very
concerned gentleman. On the disk sat a file called "MOON", which
had allegedly appeared out of nothing on Thursday, January 11th
1990. Thursday, January 11th 1990 had been a day on which there
had been a full moon. A coincidence of truly astronomic
proportions indeed!
Checking the disk revealed nothing suspicious anywhere, until
suddenly I noticed that the file was 32034 bytes long. Usually,
uncompressed pictures saved by the Batteries Included drawing
program "Degas" have that exact file length. So after loading it
into said drawing program it revealed itself as a picture of a
fractal, the graphic output of a complex mathematical formula.
Since the likelihood of a virus calculating an intricate fractal
image and then writing it to disk as a "Degas"-compatible picture
file on a day when the moon is full is impossibly small, I wrote
a letter in reply that stated that this could not possibly have
been the result of a virus.
Sometimes I wake up in the middle of the night, body perspiring
and heart beating incessantly, wondering how that file got there,
though.
5.6.3 THE KEIN VIRUS
The German Public Domain virus killer "Sagrotan" by Henrik Alt
is one of the many programs that can write a tiny program into a
bootsector that announces a disk to be virus free. This
principle, explained earlier in the book (2.12.4), is known as a
virus free disk bootsector. It simply prints a message on the
screen whenever one boots with a disk in the drive that has that
little program in its bootsector. In the case of "Sagrotan", the
text is "Kein Virus im Bootsector" (German for "No Virus in the
Bootsector"). The principle: If the message appears, there is no
virus in the bootsector. If it does not appear, you would be well
advised to check the disk with your virus killer, as the message
may then have been overwritten by something that may conceivably
be a virus.
For people that do not know German, however, this text can be
quite misleading. The manager of one of the Netherlands' biggest
Public Domain libraries told me he often receives calls of people
that complain: "My disks have been infected by the Kein Virus in
the bootsector!"
Incidentally, the Wolf Virus, which got discovered some time
ago, uses this start-up message, too!
5.7 THE "THIS DOES NOT HAPPEN TO ME" PROBLEM
Rather remarkably, there are an enormous amount of people that
still persist in the almost superstition-like belief that viruses
"don't happen to them". Reasons vary, but a few of the ones that
are heard often are "I don't play game" and "I only have original
software" (i.e. no pirate copies of anything).
Let's start with the latter, for that is probably the one most
often heard. For this reason to be valid it would mean that
viruses are to be found only on illegal copies of programs and
spread predominantly through the hackers/crackers/pirate scene.
This may, to some degree, be true. However, it is a known fact
that numerous commercial programs have at one time been supplied
with viruses on them. Yes, we are talking about infected
commercial software here, the companies involved not knowing
anything about it until it was already too late.
Below you will find a list of software that is known to have at
one time been infected. Please note that the companies of the
titles in this list, which has compiled by some official major
software distributors and myself, have all in the mean time been
notified and that only the first batch or the first few batches
of the software will ever have been sent out with viruses on
them. Even if you are afraid you might have a copy of one of
those early batches, it suffices simply to use the "Ultimate
Virus Killer" and disinfect the disk. If they turn out to
actually have a virus on them, you would be well advised to check
all your other floppy disks as well.
You should not refrain from buying any of these products on the
grounds of them being in this list, nor is there a need to sue
them or anything (and by saying this I hope they won't sue me!).
Infections in these cases always consisted of bootsector viruses
of the Signum, Ghost, Evil or Goblin variety, that can easily be
eradicated.
-----------------------------------------------------------------
Title Company
-----------------------------------------------------------------
Atari Grand Prix (Hitpack disk E version) Atari
Atari ST User cover disk 12/90 (#58) English magazine
Austerlitz PSS
Crack'ed/Bombuzal/Xenon (Hitpack disk I) Atari
Flair Paint Eigen
(first 20 or so copies)
GEM Retrace Recorder G-Data
GfA Basic 3.0 Book (the disk with it) GfA Systemtechnik
(This is a book about this basic, in German. Not the actual GfA
Basic 3.0 program manual! Only the first 1500 copies have been
infected. Further copies got a small virus killer program on
them)
Super Gridrunner Llamasoft
(very first batch)
Lombard RAC/Rally Mandarin
Man from the Council (Mega Pack version) Tynesoft
MIDI Demonstration Package Geerdes
ST Digital (Disk Magazine, second issue) Public Domain
ST Format cover disk 10/92 (#39) Future Publishing
ST Handbook Issue 3 coverdisk Wright & Hayes
(English magazine - Not all cover disks, apparently, were
infected)
Super Wonder Boy Activision
TOS cover disk 10/92 ICP
(A total of 60,000 infected copies of this German magazine have
been sent out!)
Write on! Compo
-----------------------------------------------------------------
Table of software that is known to have once been infected.
5.8 THE "VIRUSES ARE SIMPLE PROGRAMS" PROBLEM
Everybody who thinks this should be programming for a big
company, have their own very sexy secretary and drive a flashy
red Ferrari Testosteronna of sorts. Viruses are quite difficult
to program, certainly from scratch, and I am afraid the only
thing to be said in favour of virus programmers is that they are
darned smart and their products sometimes downright ingenious. I
wish I could say the contrary, really I do, but I can't.
People who still think viruses are simple programs, regardless
what, would be well advised to check out the Kobold #2 Virus or
the Beilstein Virus; they may be small, but they are certainly
not simple!
5.9 VIRUSES CAN EASILY BE DESTROYED WITH A DISK MONITOR
People who say that viruses are easily recognised using a disk
monitor obviously think that the majority of Atari users can look
at the gathering of hexadecimal values hurled on the screen when
looking at a disk's bootsector using a disk monitor and then know
whether it is a virus they are looking at or not. Granted, there
are quite a few instances when it is easy to see that a
bootsector is safe and does not contain a virus. Have a look at
figure 2 in the "pictures" folder, please, and you will see what
a disk should ideally look like. It's completely empty except for
the few values in the BIOS Parameter Block (see 2.2). There is no
virus, and you are safe. If all disks not containing a virus
would look like this, the world would be simple indeed and the
"Ultimate Virus Killer" nor this book might ever have appeared.
There are a great deal of disks, however, that look something
like figure 3 in the "pictures" folder but that don't contain a
virus anyway. Most viruses don't have the text "THIS IS A VIRUS"
contained in them and, then again, some viruses contain the text
"THIS IS NOT A VIRUS". The disks most likely to cause panic by
only looking at them with a disk monitor are the ones in the
category of games and demos. Their bootsectors could easily be
erased using that disk monitor, but this would result in the game
or demo ceasing to function altogether. And the companies
involved just keep on wondering why they get so many disks
returned due to weird loading problems?!
When talking about link viruses in this context, i.e. of being
able to destroy them using a disk monitor, the whole idea of
simply being able to recognise and destroy them is even more
completely out of the question. Simply preposterous, actually.
5.10 THE "WHAT'S ALL THE HYPE ABOUT?" PROBLEM
Remarkably, the virus problem is quite often understated
immensely. Even in reviews of virus killer software, some
reviewers mention that, and I quote, "virus are, in spite of
widespread publicity, still fairly rare". I think I understand
why these things are written: To prevent a mass exodus of users
and potential customers to computer systems that are less prone
to have viruses on them (as if these would exist), to try not to
scare the people away from computers (especially not the people
who supply the bread and butter of these magazines' employees).
There is little I can say about this. All I know is that a large
percentage of "Ultimate Virus Killer" customers have written in
to let me know that they had killed several or numerous viruses.
Given the fact that viruses don't really care if you're a user of
legitimate software or a pirate, and that there is really not
much at all you can do to make sure you never get damaged by them
(except by using a good virus killer), I think it is dangerous to
underestimate the problem. Personally I would tend to think that
at least half of the Atari user base has had, has, or will have
virus problems some day, and that's probably a conservative
estimate. Considering the fact that there are over a million
Atari users all over the world, that is not a problem that should
be covered up.
Even if these journalists would be right, they should change
their line to "viruses are, thanks to widespread publication,
fairly rare."
5.11 VIRUSES AND THEIR THREAT FOR THE HARDWARE
Theoretically it is possible to have viruses physically destroy
your computer's hardware. In this paragraph some of the
principles behind that will be hinted at. I gave long thought to
all of this, as it was possible that information would be given
for virus authors to use in the future. However, apart from the
fact that some of this information has been published before
(German Atari magazine "ST Magazin", of March 1989) and all this
information can be obtained from books the likes of "ST
Internals" anyway, it is fairly certain that the people who know
how to interpret this information are the same kind of people
that would probably already know everything written here. Other
people will simply read what is possible, but will be left in the
lurch as to how to do it in detail - as the 'intimate' details
will, of course, not be revealed.
The possibility of viruses hitting the street that use these
'techno destructo' techniques is small, as extensive knowledge of
both the hardware and machine code programming is required. And,
of course, viruses might one day get back to their author and I
don't think any virus author is prepared to run that risk...
5.11.1 THE FLOPPY DRIVE
As we all know, a floppy disk only has a limited amount of
tracks, and usually they are counted from 0-79 to 0-81. It is
easy to de-adjust the read/write head of the floppy drive if one
repeatedly tries to read a negative track number, or any track
beyond (approximately) track 86. These tracks do not exist, and
if the step rate is set to 2 milliseconds only some basic Floppy
Disk Controller commands are needed for this to be achieved.
Using similar commands offered by the Floppy Disk Controller, it
is possible to repeatedly switch the drive on and off. During the
switching-on procedure, the disk drive motor gets more Ampère
than usual, which leads to higher rotating speeds and a shorter
life span.
5.11.2 THE MMU
The MMU, which is short for Memory Management Unit, can also be
damaged. This is one of the custom chips inside an ST. The Memory
Management Unit is merged into another chip on the TT and the
Falcon.
As you may or may not now, the MMU is a so-called CMOS chip, the
kind of chip which only uses power when it is actually busy with
something. The MMU is used quite often, mainly for memory
management like its name implies, but normally this does not lead
to the development of excessive heat. With the use of but a few
commands it is possible to keep the MMU perpetually active. This
will lead to overheating, which may damage the chip. Because the
TT and Falcon have the MMU integrated within another chip, damage
will only be more substantial.
5.11.3 THE HARD DISK
Whereas the same 'tricks' that were mentioned before with
'floppy disks' can also be applied to hard disks, there is also a
method of destruction that can only be used with the latter
storage medium.
Most people do not know that the actual data carrier in a hard
disk has pre-formatted tracks that contain so-called servo
information that is needed for the positioning of the read/write
head, even before the disk is 'formatted' by the user. This servo
information consists, among other things, of index markers that
signal the HD controller where a track actually starts. Ordinary
system interfaces do not offer any possibilities for the user to
read these, nor change them. If one was to result to direct HD
controller programming, however, it would be possible to read and
delete this information with quite a few hard disk types,
rendering the internal data carrier technically in tip-top shape
yet completely useless. Only the hard disk manufacturer would be
able to repair this damage.
5.11.4 THE INTERFACES
It is possible to damage either a device connected to your
computer or, indeed, the computer itself, by manipulating the MFP
(Multi Function Peripheral) chip. It is possible to occupy
register 22 (Printer Busy Signal) with the value of the GPIP
register by inverting the Data Direction Register (DDR). This
will cause two out-pulses to crash on each other, which can lead
to damage to one of the systems (computer or printer). If it is
the computer, the MFP is probably the victim - and that's an
expensive joke.
Rumours existed once of an ST virus that was able to destroy
your printer, supposedly using this method, but this has never
actually been sighted and there is grave doubt whether it
actually exists. Like many of such rumours, it is thought to have
belonged to the late eighties' German virus hype. Curiously, only
one specific German virus killer was said to recognise those
rumoured viruses, even though yours truly's having hacked around
in that virus killer's program code did not discover any viruses
being recognised other than the usual ones.
5.11.5 THE FALCON
When Atari added the Falcon to their range of computers, they
produced a very powerful and extremely flexible system.
Especially with regard to the video hardware, the Falcon is so
powerful that Atari has limited the Operating System severely so
the user is protected from doing things that would cause damage
to his monitor. In theory, the Falcon's video chip can specify
the amount of x pixels, the amount of y pixels, the amount of
colours, and the horizontal and vertical hertz rate of a display
independently. When accessing the Falcon's video hardware
directly, it is easy to install values that your monitor cannot
cope with, which can cause it to actually get damaged. This is
especially likely if you haven't connected a Multisync monitor.
It would be quite easy for viruses to install hertz frequencies
beyond any monitor's limits.
Additionally, as has already been mentioned before, the Falcon
has a small bit of Non-Volatile RAM where configurations can be
stored specifying the machine's initial boot configuration. It is
extremely easy to configure the Falcon to boot in a resolution
that cannot be displayed on, for example, a VGA monitor. If you
are the owner of one of these display units, that can be quite a
drag.
5.12 ALIEN VIRUSES AND THEIR THREAT TO ATARI TOS COMPUTERS
Since Atari TOS computers use the same kind of disk format as
MS-DOS computers, it is possible to read from and write to MS-DOS
disks on them. Is there now a potential threat for us where PC
viruses are concerned?
Not really.
For starters, the so-called executability checksum that the
Atari Operating System calculates to see if a bootsector is
executable is generated in a totally different way by an MS-DOS
computer. The bottom line here is that no Atari virus in an
Atari-executable bootsector will be found to be executable on an
MS-DOS system and, the other way around, no MS-DOS virus in an
MS-DOS- executable bootsector will be found to be executable on
an Atari system. And even if an MS-DOS virus bootsector would be
executable according to the Atari Operating System criteria, it
would just lead to a crash because MS-DOS Intel processor machine
code cannot run on an Atari Motorola processor.
However, there are so-called PC Emulators, hardware or software
things that allow for the use of MS-DOS-compatible software on
the Atari platform. Software like this is "PC Ditto" and "Soft
PC", whereas there are hardware emulators called "AT Speed" and
"Falcon Speed" as well as some others. When you're in the MS-DOS
mode of such an emulator, MS-DOS viruses will be able to work on
your system, especially link viruses. From MS-DOS mode they can
even affect Atari data, though back in Atari mode any software
infected with an MS-DOS virus will just crash, not actually
install any kind of virus or multiply itself.
Principally, any computer's viruses will be able to work on the
Atari system if only you're using a good enough piece of
emulation software and/or hardware. There are MS-DOS and Apple
MacIntosh emulators, but Sinclair QL and Sinclair ZX81 emulators
also exist. And there's even an Apple ][ emulator for the Apple
MacIntosh that can run on a MacIntosh emulator within the Atari.
The future may even have yet other emulators up its sleeve. The
same rules will apply to these as well.
