%%File: VIRS0528.TXT
%%Name/Aliases: Maltese Amoeba, Irish, Grain of Sand
%%Platform: PC/MS-DOS
%%Type: Program., Memory resident - TSR, 
%%Disk Location: COM application., EXE application.
%%Features: Memory resident; TSR., Polymorphic
%%Damage: Overwrites MBR/prints msg on 11/1 & 3/15
%%Size: Variable, dur to variable length of encryption header, 
Polymorphic: each infection different
%%See Also: 
%%Notes: widespread in Ireland& UK, a dangerous polymorphic multi-
partite fast infector  (virus-l, v5-006)
On Nov 1 or March 15 it replaces MBR of hard drive and displays a 
message that says something like 
"Amoeba virus by Hacker Twins...Just wait for Amoeba 2".  The message 
refers to he University of Malta.  This virus was probably very aware 
(or wrote) the Casino virus, as when it initially infects, it checks for 
the existance of the Casino, and if its there, it takes over INT 21 from 
it (thereby eradicating Casino) and places itself there instead.  
Signature scans don't work for this virus, an algorithmic check is the 
best way to locate it.  
No strange activity until activation date, at which point much text gets 
printed to the screen and the computer hangs.   
Not many anti-viral programs as of March 6, 1992.  Data Physician Plus! 
v3.0D  
Note: PKZIP 2.04C causes false positives for this virus, especially with 
CPAV, or the microsoft version of CPAV.