Lamer Exterminator

Lamer Exterminator is a computer virus created for the Amiga. It was first detected in Germany in October 1989. It is a boot block virus contained in the first 1024 bytes of the disk.

It is notable as the first virus known to be defensive. It hooks into the system in such a way that examining a bootblock will return a normal result and upon replicating will also encrypt itself.

Variants of the virus are known to use one of three different decrypt routines defined by The Amiga Virus Encyclopedia.[1] A detection program can look for any of the known decrypt routines on the boot block area of the disk, or alternatively try to blindly brute force decrypt them. The first decrypt routine is a simple XOR of every byte which only takes a maximum of 256 attempts to decrypt. The next includes an add byte in its decrypt routine, and takes a maximum of 256×256 attempts. The third uses 16 bit words in its decrypt routine, and takes a maximum of 65535×65535 attempts, which makes it less practical to solve. The first two versions (and variants that use the same decrypt routines), can also be identified as containing an identification word 0xABCD, as the last data on the boot block containing anything but zero values.