Help us preserve and detect historical Amiga malware.
AmiGuard is an open-source antivirus for classic Amiga systems, targeting AmigaOS / Kickstart 1.2+ and Motorola 68000. To build trustworthy detections, we need authentic historical samples that can be analyzed and verified safely.
Submit suspected Amiga malware at amiguard.ploos.no. Please do not attach malware to GitHub issues, pull requests, discussions, or repository commits.
Why we are asking for samples
We do not want to guess. A named virus should only produce an INFECTED verdict after its detection has been backed by an actual sample, independent analysis, clean-corpus regression testing, and native Amiga runtime qualification.
Historic Amiga antivirus collections are not generally available to new projects. Some established teams explicitly do not redistribute their collections, and relying on xvs.library would not meet AmiGuard's goal of having its own open detection engine with support reaching back to AmigaOS 1.2.
What we are looking for
Bootblock viruses
Original infected ADFs, disk images, or raw bootblocks with known or suspected infection.
File / link viruses
Infected Amiga executables, HUNK files, libraries, commands, or other affected files.
Trojans
Historical Amiga trojans where provenance, original filename, source, or contemporary notes are known.
Old private collections
Archived material from BBSes, repair disks, personal collections, backups, magazines, or recovered media.
How to prepare a submission
The public intake service is available at amiguard.ploos.no. Please preserve original files unchanged. We prefer:
- the original sample or disk image, not a modified recreation;
- a SHA-256 hash if you can provide one;
- the original filename and approximate date, if known;
- where it came from, such as a disk, BBS, archive, collection, or publication;
- any known virus name, antivirus verdict, or historical notes;
- any archive password or other handling note kept separately for later reference with the submission ID; the intake service does not automatically extract archives.
Do not execute suspected malware
Please do not run a suspected sample merely to identify it for us. Preserve the artifact as-is. AmiGuard's research workflow is designed around offline hashing, metadata intake, static analysis, isolated testing, and read-only verification wherever possible.
What happens after we receive a sample
Receipt of a file does not automatically mean we will call it malware. Unknown and suspicious artifacts remain research material until the evidence supports a specific conclusion.
Privacy, rights, and publication
Please only submit material you are entitled to share for security research and preservation. Do not submit personal documents, credentials, private communications, or unrelated data. The intake service assigns a random submission ID and records SHA-256, size, receipt time, and consent state; the original client filename is not retained. Unclassified submissions are normally retained for up to 90 days, while material selected as research evidence may be retained longer when needed. Samples are not automatically committed to the public AmiGuard repository, and there is no public sample retrieval endpoint.
About EICAR
AmiGuard currently uses the harmless EICAR antivirus test file to qualify parts of the file-signature pipeline. EICAR is a safe-test, not Amiga malware, and it is not evidence that AmiGuard detects a real historical Amiga virus.
Submit a sample
Open the AmiGuard sample submission service. After a successful submission, keep the receipt's submission ID and SHA-256 if you need to refer to the sample later.
Follow the project
Source code and research tooling are developed openly in Ploos-AS/AmiGuard.