Facts

• TTV1 was the first file-based Amiga virus
• Its creation was a fun experiment. It was inspired by the boot block based SCA virus which had reached dubious fame due to its very successful spreading and the flaw of overwriting the boot block. Would it be possible to create a self spreading file, thus breaking out of the boot block dread?
• Development took place between spring and fall 1988.
• The early code name was HOUZ virus.
• Thinking up the name we tried to find something that would sound mean and at the same time on the verge to ridiculous. The final name was inspired by a rap band called The Terrorists.
• The virus does not harm the system. In fact, care was taken to avoid any even unintentional damage.
• Identity of the authors was kept secret for 30 years. It was officially revealed on March 9, 2019 at the Demonights 008 event in Bern Switzerland
• "The names have been changed to protect the innocent" shown in the message was inspired by the song Beat Dis by Bomb the Bass. They have sampled it from the Dragnet radio series.
• The "BGS9" was in fact a clone. Its code is almost identical even including the resident name "TTV1". It got more reach and thus was regarded as the origin.

About the life of the beast

1. TTV1 installs itself as a reset proof resident module (KickTag/ROMTag) named "TTV1"
2. On reset the resident module (virus) is called
3. Execution gets delayed in order to gain disk write access. Therefore Intuition's OpenWindow function is redirected.
4. As soon as the AmigaDOS tries to open the CLI window the OpenWindow gets called the virus looks for the startup-sequence on the booted disk
5. The virus is looking for the first command (A) in the startup-sequence
6. File request windows (e.g. "Disk is write protected") are being temporarily disabled
7. Virus renames A to $a0202020a02020a020a0a0. This is a combination of none breaking spaces and spaces. The idea is that the user will oversee this "invisible" file.
8. Virus writes itself as an executable command with the name of A to the disk
9. Eventually A gets loaded and executed with all its parameters by the virus

• 2 modes - text and graphic mode
• difficult ram organisation for graphic mode
• difficult to paint text (no routine)