The malware rules presented in Unwired are not really to my liking. I find them to be too clunky and rather bland. Instead, I've tried to come up with a system that makes the little buggers more colorful and actually have an impact on gameplay.
Alternative Malware rules
As the computer virus is modeled after the concept of the biological virus, malware basically uses the rules for Diseases (Augmentation pg. 129) except where noted otherwise. They infect nodes as a whole, influencing their behavior on a fundamental level.
Note: Disregard the Anti-Virus program option for these rules and replace the Purge program with Anti-Virus, which protects against infection and combats active viruses.
Malware Attributes
Vector
Malicious programs have different ways to infect other systems. The most common types encountered are Fire-and-Forget, Connection and Download.
Fire-and-Forget malware must be triggered directly in order to become active. The hacker has to load it as an active program and send it with a Complex Action against the target.
Connection type malware is proactive and automatically tries to infect any node that establishes a connection to the infected system.
Download malware hides itself in the code of other files and only becomes active when the host data is downloaded and executed on another system.
Speed
This is the amount of time that needs to pass between infection of a system and the first effect resistance test. Additionally, the virus becomes active again after the same time period has elapsed. All computer malware count as being incurable for the purpose of determining the maximum life span. The power will accumulate always until the virus is purged from the system.
Penetration
Some codes are so sophisticated that they can undermine the most common defenses employed against them. Reduce the effective rating of the Anti-Virus program by the Penetration rating.
Power
A malware's Power determines if and how powerful it can effect a system. See Effects below for details.
Nature
Malware either operates through a Slow Virus approach, Brute Force methods or acts as a Trojan.
A Slow Virus needs to succeed on an extended test with Power x2 (target's Firewall, 1 Minute) in order to infect a system. If successful, the victim gets a free Firewall + Anti-Virus (Malware's Power) test to notice the infection. The target can escape the danger by unsubscribing from the infected node before the test is successful. A Fire-and-Forget Slow Virus deletes itself after losing contact with the intended target.
Brute Force types make the same test, but their time interval is 1 Combat Round. The target gets a free Firewall + Anti-Virus (Malware's Power) test to notice the threat after each attempt.
Trojans automatically infect any system on which they are executed. Note that this Nature also applies to files downloaded from systems infected with Fire-and-Forget and Connection type malware.
Effect
This is what a malware will actually do to an infected systems. Some effects are merely annoying, others may be downright lethal. Systems resist the Power with Firewall + Anti-Virus. Re-calculate and apply the results after each Speed time interval.
Altered Appearance
The malware tries to override sculpetd imagery settings, changing any Icon run on the infected system according to its predefined programming as long as its Power is not reduced to 0. This can have pretty bizarre results if original iconography and desired effects differ strongly.
Breadcrumb Trail
A system infected with this kind of malware constantly sends out small data packages to a predefined address that contain information about the connections established with other nodes. The people on the receiving end get the accumulated Power as a bonus to all Trace actions against the infected system. The malware leaves a data trail though that may itself be traced at -2.
Crash Connection
Whenever this Malware becomes active, it tries to crash the system's connections to other nodes. One subscription is unsubscribed for every point of accumulated Power that exceeds the System rating. The malware's programmer may specify that only specific access IDs will be disconnected, or set a list of priorities for which connections will be terminated first.
Delete Program
This nasty virus tries to delete key files of programs currently running on the system. If its accumulated Power exceeds the System rating, one program becomes unresponsive and cannot be used anymore (does not add any dice to tests). This may be chosen at random or according to a predefined list of priorities.
Freeze
Causing random glitches and bandwidth problem, this code may slow infected systems down to a crawl. It reduces Matrix Initiative by its accumulated Power. If reduced to 0, the node is completely unresponsive.
Icon Damage
The malware tries to disrupt Matrix presence by injecting faulty code into Personas. All active Personas running on the infected system must resist (accumulated Power) DV Matrix damage with System + Armor when the malware becomes active.
Information Distortion
Malware of this type has been created to alter information in a specific way. It may be used as a Spam program to insert advertising into data or to spread messages and disinformation. When executing a Data Search, it reduces the number of 1s needed for a glitch by its accumulated Power (minimum 1). If a glitch occurs, the result has been altered in a way determined by the malware's programming. Depending on the creator's intend, this may only apply to Data Searches for certain topics.
Leech
These viruses divert system resources to another node, increasing their capabilities at a cost to their host. If the accumulated Power exceeds the System rating, the infected node's Response is effectively reduced by 1. The receiving system treats its Response as being one point higher for the purpose of calculating the Processor Limit. This creates a data trail that may be traced to its destination.
Physical Damage
This dangerous virus creates a lethal biofeedback just like the Black Hammer program. The DV is equal to the accumulated Power. It is able to jam connections open like Black IC, using accumulated Power x2 for the test.
Psychotropic
Using subliminal Simsense biofeedback, this malware is able to recondition a person's mind to new forms of thought and behavior. Make an opposed test with the target's Willpower + Biofeedback Filter against a dice pool equal to the accumulated Power when the Malware becomes active. A user must be connected via hot or cold Sim in order to be affected. If the malware wins, the target gains a Negative Quality as determined by the programmer.
Reroute
Whenever the malware becomes active, it opens a connection to a specific Access ID as long as its Power isn't reduced to 0. This might be just an online shop looking for new customers, but could also be a trap node full of other viruses.
Resource Hog
Once active, this virus redirects system resources to itself, hampering its host's performance. When calculating the Processor Limit, increase the number of active programs by the accumulated Power.
Stun Damage
This effect is identical to Physical Damage, except that it causes stun damage instead.
Undermine
Malware of this type integrates itself into the host system's firewall, creating openings that may be exploited for easy access. If the accumulated Power exceeds the Firewall rating, an Exploit is created.
Viruses and Malware
Buzz
Vector: Connection
Speed: 1 day
Penetration: 0
Power: 4
Nature: Slow Virus
Effect: Psychotropic (BTL addiction), Reroute
The Choson Seolpa Ring's tool for customer acquisition has become a street legend in its own right, a boogeyman corp PR likes to bring up when they warn their employees about accessing external nodes. It does not only addict its victims to BTLs but also opens connections to Choson BTL distribution nodes where they can indulge their new cravings right away.
Drain 01
Vector: Fire-and-Forget
Speed: 1 day
Penetration: -1
Power: 2
Nature: Brute Force
Effect: Leech
This open-source-project is popular with hacker gangs that like to get a little boost at the expense of people who are too dumb to get some protection for their commlinks. Over the years countless up-and-coming hacker kids have profited from the little edge it provides.
Erika Adserver-3
Vector: Download
Speed: 1 hour
Penetration: 0
Power: 3
Nature: Trojan
Effect: Information Distortion
Neonet sells this spam program still under the Erika label to other companies, who hide it in demo files and freebies. It is designed to insert ad messages in other downloads, preferably those from the competition. Cracked versions are very popular with Policlubs and e-activists, who use it to spread their own propaganda.
LSMD Fox Hunt
Vector: Download
Speed: 10 minutes
Penetration: -4
Power: 4
Nature: Trojan
Effect: Breadcrumb Trail
Lone Star's Matrix Division created the Fox Hunt to tag money transactions in ransom or extortion cases. It was designed in cooperation with the leading providers of anti-virus software and can subvert most commercially available protection with ease. Better spend your money while you still can.
MCT Active Competition
Vector: Connection
Speed: 1 day
Penetration: 0
Power: 3
Nature: Slow Virus
Effect: Resource Hog, Information Distortion
Mitsuhama's “aggressive advertising campaign strategy” gave birth to this very annoying piece of malware. It subverts the integrity of a system and causes it to slow down remarkably. If the user looks online for information about this problem, it feeds him false reports that claim that this would be a well-known bug of his OS, but the manufacturer shows no interest in patching it up. Unlike, you know, MCT who always think of their customers first yada yada...
Systems running a Mitsuhama-brand OS do not suffer from these problems for obvious reasons, but may still act as a carrier.
Neon Acid
Vector: Fire-and-Forget
Speed: Immediately
Penetration: -1
Power: 3
Nature: Brute Force
Effect: Alter Appearance, Icon Damage, Delete Program (random)
This simple yet effective combat virus is favored by Matrix thrill gangs for virtual drive-by attacks. It simulates the effects of real acid by marring the victim's icon, causing damage to it and deleting programs from his memory.
0A-SyS @ccess@ll@reas
Vector: Connection
Speed: 1 hour
Penetration: 0
Power: 3
Nature: Slow Virus
Effect: Undermine
Triple-A was created by the neo-anarchistic hacker collective 0A-SyS as a means to further the free flow of information. They use it mostly to subvert the defenses of commercial libraries and private virtual schools, but its unpredictable spread pattern means that no one is really safe from it – and that's just the way the info-anarchists like it.
The Grey Plague
Vector: Connection
Speed: 1 minute
Penetration: 0
Power: 4
Nature: Brute Force
Effect: Altered Appearance, Delete Program (random), Icon Damage
No one knows for sure who created this virus, and after the appearance of The Black Plague (see below) it has become quite unlikely that anyone will make the claim. It spread like a wildfire some time ago and even forced the Grid Overwatch Division to step in. Persona icons in infected systems look like they would rot away and rapidly degrade until they crash. Luckily all up-to-date virus protection programs are well equipped to defend against it, but mutated versions crop up from time to time.
The Black Plague
Vector: Connection
Speed: 1 minute
Penetration: -2
Power: 4
Nature: Brute Force
Effect: Altered Appearance, Delete Program (random), Physical Damage
The origins of the Black Plague are just as mysterious as its grey predecessor. It suddenly appeared some time after GOD managed to contain the Grey Plague outbreak and quickly proved to be even more dangerous. Maybe the Grey Plague was just a prototype that was perfected later, or the intelligent code of the virus created a more advanced version as a reaction to GOD's attack. Technomancers have found hints of dissonant code in its structure, what further complicates the matter. The Black Plague generates a barrage of random noise signals of incredible intensity that may reach lethal levels, endangering every user in an infected system.
ZYX-Web
Vector: Fire-and-Forget
Speed: Immediately
Penetration: 0
Power: 5
Nature: Brute Force
Effect: Altered Appearance, Freeze, Resource Hog
The original ZYX-Web was designed by the infamous decker Widow in the last matrix age. It is not known who has created a remake for the wireless matrix, as Widow presumably died during the Crash 2.0. The new version seems to be just as good as the original, however. The malware traps the victim's persona in slim strands of moonlight, restricting his movement up to total helplessness.
(So how about creating a seperate sub-forum for house rules?)
