===== Computer Virus Catalog 1.2: 10_Past_3.748 Virus (20-FEB-1993) ==== Entry...............: 10_Past_3.748 Virus Alias(es)...........: Tea Time Virus Virus Strain........: 10_Past_3 Virus Strain Virus detected when.: where.: South Africa (common in Jan.1993) Classification......: Resident COM infector (appending),armouring Length of Virus.....: 1.Length (Byte) on media: 748 Bytes 2.Length (Byte) in memory: 748 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Type of infection...: Self-Identification in memory: mem[1ACh..1AFh] = 46h 42h 06h 22h Self-Identification on media: file's end: 06h 22h Infection Trigger...: Execution of an infected COM program with 4<=LengthCOM<=64496. Storage media affected: Interrupts hooked...: INT 21h function 4Bh Damage..............: Permanent Damage: --- Transient Damage#1: Reboot during INT 21h. Transient Damage#2: Tamper with interrupt vectors so as to hang PC. Transient Damage#3: Install new keyboard handler which affects Shft&Ctrl states. Damage Trigger......: Permanent Damage: --- Transient Damage#1: Reboot on any 22th day in 1991 and any year after. Transient Damage#2: In 1991 and any year after: If day=29 then trash INT 13h; If day= 1 then trash INT 9h; If day=10 then trash INT Dh; If day=16 then trash INT 10h. Transient Damage#3: Between 15h10min and 15h13min, AND if INT 21h occurs THEN install keyboard handler which sets Shft & Ctrl states randomly on about 1 in 11 key- strokes. Particularities.....: Reported in South Africa; purportedly written by a person with the pseudonym Marvin Giskard. Similarities........: Other variant: 10_Past_3.789 --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: CSIR Computer Virus Research Lab, Pretoria, RSA Classification by...: Paul Ducklin Documentation by....: Paul Ducklin (CARObase) Klaus Brunnstein (converted to CVC format) Date................: 1993-February-15 Information Source..: Reverse-Engineering of virus ===================== End of 10_Past_3.748 Virus ======================= ===== Computer Virus Catalog 1.2: 10_Past_3.789 Virus (20-FEB-1993) ==== Entry...............: 10_Past_3.789 Virus Alias(es)...........: --- Virus Strain........: 10_Past_3 Virus Strain Virus detected when.: where.: South Africa (common in Jan.1993) Classification......: Resident COM infector (appending),armouring Length of Virus.....: 1.Length (Byte) on media: 789 Bytes 2.Length (Byte) in memory: 789 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Type of infection...: Self-Identification in memory: mem[1ACh..1AFh] = 46h 42h 06h 22h Self-Identification on media: file's end: 06h 22h Infection Trigger...: Execution of an infected COM program with 4<=LengthCOM<=64496. Storage media affected: Interrupts hooked...: INT 21h function 4Bh Damage..............: Permanent Damage: --- Transient Damage#1: Display message and reboot during INT 21h. Message: Ah Ah Ah Ah Ah "Therese" Ah Ah Ah Ah Ah Transient Damage#2: Tamper with interrupt vectors so as to hang PC. Transient Damage#3: Install new keyboard handler which affects Shft&Ctrl states. Damage Trigger......: Permanent Damage: --- Transient Damage#1: Display and reboot on any 22th day in 1991 and any year after Transient Damage#2: In 1991 and any year after: If day=29 then trash INT 13h; If day= 1 then trash INT 9h; If day=10 then trash INT 0Dh; If day=16 then trash INT 10h. Transient Damage#3: Between 15h10min and 15h13min, AND if INT 21h occurs THEN install keyboard handler which sets Shft & Ctrl states randomly on about 1 in 11 key- strokes. Particularities.....: Reported in South Africa; purportedly written by a person with the pseudonym Marvin Giskard. Similarities........: Other variant: 10_Past_3.789 --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: CSIR Computer Virus Research Lab, Pretoria, RSA Classification by...: Paul Ducklin Documentation by....: Paul Ducklin (CARObase) Klaus Brunnstein (converted to CVC format) Date................: 1993-February-15 Information Source..: Reverse-Engineering of virus ===================== End of 10_Past_3.789 Virus ======================= ======== Computer Virus Catalog 1.2: Adolf Virus (20-FEB-1993) ========= Entry...............: Adolf Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: --- where.: --- Classification......: Resident, appending COM-file infector. Length of Virus.....: 475 bytes on disk/memory --------------------- Preconditions ----------------------------------- Operating System(s).: MS-DOS Version/Release.....: 2.xx and above Computer model(s)...: IBM PC, XT, AT and compatibles --------------------- Attributes -------------------------------------- Easy Identification.: The code contains the text: " Adolf Hitler ", and the fourth byte will be an ASCII '5' = 35h. Self Identification.: The virus will not infect a file, if fourth byte is 35h. It stores itself in memory, starting at position 0000:0200 if there isn't a BBh (the first code-byte). Type of infection...: Starting an infected file will make the virus resident before executing the file correctly. At execion time of an uninfected file, the virus appends itself to the file's code. Infection Trigger...: INT 21h load/execute function if the virus is active in memory. Storage media affected: All files at each locations. Interrupts hooked...: INT 21h functions 4Bh(load/execute) and 41h(delete), INT 24h. Damage..............: Nothing except infection. Damage Trigger......: --- Particularities.....: If the virus is active in memory and INT 21h function 41h is called, a deletion will only succeed if bits 0 and 1 of BIOS-parameter 046C (Timer) are not set both. Similarities........: --- --------------------- Agents ------------------------------------------ Countermeasures.....: Skulasons F-PROT 2.06a, McAfee SCAN V99. Standard means......: Reboot and delete infected files. --------------------- Acknowledgement --------------------------------- Location............: Virus Test Center, University of Hamburg, Germany. Classification by...: Stefan Haack Documentation by....: Stefan Haack Date................: 01-FEB-1993 Information Source..: Virus-code analysis ===================== End of Adolf Virus ============================== ======== Computer Virus Catalog 1.2: Alabama Virus (20-FEB-1993) ======= Entry...............: Alabama Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: October 1989 where.: Israel Classification......: Resident, appending EXE infector. Length of Virus.....: 1) Length on media: 1408 bytes --------------------- Preconditions ----------------------------------- Operating System(s).: MS-DOS Version/Release.....: 2.xx and above Computer model(s)...: IBM PC, XT, AT and compatibles --------------------- Attributes -------------------------------------- Easy Identification.: --- Self Identification.: File create/edit time contains 63 seconds. First 4 bytes of memory are 0h. Type of infection...: Appends itself to the executed file. Infection Trigger...: Any INT 21h load/execute function-call. Storage media affected: All files on each locations. Interrupts hooked...: INT 21h function 4Bh (load and execute); INT 24h. Damage..............: Permanent damage: --- Transient damage: One hour after the start of an infected program, the following message will be displayed: "SOFTWARE COPIES ARE PROHIBITED BY INTERNATIONAL LAW", "Box 1055 Tuscambia ALABAMA USA" The message is encrypted by the NOT function. Damage Trigger......: Permanent damage: --- Transient damage: 1 hour after starting an infected program. Particularities.....: --- Similarities........: --- --------------------- Agents ------------------------------------------ Countermeasures.....: Skulasons F-PROT 2.06a, McAfee SCAN V99. Standard means......: Reboot and delete infected files. --------------------- Acknowledgement --------------------------------- Location............: Virus Test Center, University of Hamburg, Germany. Classification by...: Michael Haack Documentation by....: Michael Haack Date................: 01-FEB-1993 Information Source..: Virus-code analysis ===================== End of Alabama Virus ============================ ======== Computer Virus Catalog 1.2: CHEMNITZ Virus (20-FEB-1993) ====== Entry...............: CHEMNITZ Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: University of Chemnitz, Germany where.: December 1992 Classification......: Memory-resident, appending EXE- and COM-Infector Length of Virus.....: 1) Length on media: 772..778 Bytes 2) Length in memory: 848 Bytes --------------------- Preconditions ----------------------------------- Operating System(s).: MS-DOS, DR-DOS Version/Release.....: MS-DOS 2.xx upward Computer model(s)...: IBM - PC, XT, AT, upward and compatibles --------------------- Attributes -------------------------------------- Easy Identification.: 1) Enlarged file size: using DIR, compare actual file size with original file size. 2) Reduction of available memory: using CHKDSK or MEM, memory size will be reduced by 848 bytes. 3) The following signature is found 20Ah (522) bytes before end of every infected file: 'FMCIKLMOF' = 46 4D 43 49 4B 4C 4D 4F 46 (hex) Type of infection...: It infects previously uninfected EXE and COM files when loaded with INT 21, function 4B00h by appending itself to program on media, and makes itself memory-resident. It infects COM and EXE files only once, but does not infect COMMAND.COM. Infection Trigger...: Invocation of INT 21h, Function 4B00h Interrupts hooked...: INT 21h, function AH=4B (Load&Execute) Storage media affected: All COM and EXE files (FD,HD) if not write-protected Damage..............: Pernament damage: --- Transient damage: --- Damage Trigger......: --- Particularities.....: --- Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Boot from clean system; delete infected files and replace with uninfected originals from backup. --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Mark Broecker Documentation by....: Mark Broecker Date................: 19-January-1993 Information Source..: Reverse-Engineering of original virus (received from site of first report: U-Chemnitz) ===================== End of CHEMNITZ Virus ============================ ==== Computer Virus Catalog 1.2: Exe_Bug.A Virus (20.February-1993) ==== Entry...............: Exe_Bug.A Virus Alias(es)...........: CMOS Virus Virus Strain........: Exe_Bug Virus Strain Virus detected when.: where.: South Africa (there common in January 1993) Classification......: Memory-resident System (MBR,FBR) infector, stealth, tunnelling. Length of Virus.....: 1.Length (Byte) on media: 1 sector 2.Length (Byte) in memory: 1 kByte --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: Self-Identification in memory: --- Self-Identification on disk: MBR[28h] = 7Ch System infection: MBR/FBR infector; saving original boot sector at 0/0/17 (HD), at 40/0/1 (360 kB) and at 80/0/1 (any other floppy). Infection Trigger...: At bootup from an infected floppy (hard); during INT 13h/AH=02 (floppy) Storage media affected: HD/FD Interrupts hooked...: INT 13h/02, INT 13h/03 (stealth mechanism) Damage..............: Permanent Damage: Sectors on hard drive converted to disc-trashing trojan; sectors on floppies converted to virus- dropping trojan. Transient Damage: --- Damage Trigger......: Permanent Damage: Condition=Int13h/write AND sect=3 AND buffer[0]='M' AND ((disc=hard AND 512<=trk<768) OR (disc=flop AND sect=3)) Transient Damage: --- Particularities.....: CMOS setup is altered to reflect "drive A: not installed", causing some BIOSes to give up bothering to boot from floppy. Virus is thus able to subvert a clean boot by attempting floppy bootup *after* loading itself from the hard drive. Similarities........: Exe-Bug.Hooker Virus --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: Classification by...: Paul Ducklin Documentation by....: Paul Ducklin (CARObase) Klaus Brunnstein (conversion to CVC format) Date................: 1993-February-15 Information Source..: Reverse-Engineering of virus code ===================== End of Exe_Bug.A Virus =========================== ==== Computer Virus Catalog 1.2: Exe_Bug.Hooker Virus (20-Feb-1993) ==== Entry...............: Exe_Bug.Hooker Virus Alias(es)...........: --- Virus Strain........: Exe_Bug Virus Strain Virus detected when.: where.: South Africa (there common in January 1993) Classification......: Memory-resident System (MBR,FBR) infector, stealth, tunnelling. Length of Virus.....: 1.Length (Byte) on media: 1 sector 2.Length (Byte) in memory: 1 kByte --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: Self-Identification in memory: --- Self-Identification on disk: MBR[60h..61h]=BAh 80h System infection: MBR/FBR infector; stores original boot sector at location At 0/0/17 (HD) or at LAST_R (FD) Infection Trigger...: At bootup from an infected floppy (hard); during INT 13h/AH=02 (floppy) Storage media affected: HD/FD Interrupts hooked...: INT 13h/02, INT 13h/03 (stealth mechanism) Damage..............: Permanent Damage: Sectors on hard drive converted to disc-trashing trojan. Transient Damage: --- Damage Trigger......: Permanent Damage: INT13h/write AND buffer[0..1]="MZ" AND CL=counter Transient Damage: --- Particularities.....: Can't format floppies. Virus contains encrypted text "HOOKER" (NOT displayed as message). When the Trojan (48 bytes long) is written to disk, string "HOOKER" is appended to it. Similarities........: Exe-Bug.A Virus --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: Classification by...: Paul Ducklin Documentation by....: Paul Ducklin (CARObase) Klaus Brunnstein (conversion to CVC format) Date................: 1993-February-15 Information Source..: Reverse-Engineering fo virus code ===================== End of Exe_Bug.A Virus =========================== ==== Computer Virus Catalog 1.2: FLIP.2343 Virus (20-February-1993) ==== Entry...............: FLIP.2343 Virus Alias(es)...........: --- Virus Strain........: FLIP Virus Strain Virus detected when.: July 1990 where.: Germany Classification......: Multipartite (COM, EXE, Boot, MBR); Encrypted Length of Virus.....: 1) Length on media: 2343 Bytes 2) Length in memory: 3064 Bytes --------------------- Preconditions ----------------------------------- Operating System(s).: MS-DOS Version/Release.....: Version >=3.0 Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes -------------------------------------- Easy Identification.: --- Type of infection...: EXE standard append COM standard append MBR standard;the partition size is decreased by 6 sectors. Boot standard Infection Trigger...: --- Storage media affected: HD and Floppy Interrupts hooked...: INT 01h; INT 10h; INT 13h; INT 1Ch; INT 21h; INT 9Fh Damage..............: Permanent Damage: --- Transient Damage: the screen ist flipped horizontally. A special character set makes the screen look like if one looks from inside out. This effect only works on EGA or VGA displays. Damage Trigger......: Permanent Damage: --- Transient Damage: Effects occur on every 2nd of any month between 16:00 and 16:59. Particularities.....: Due to a bug, an early Flip variant is not able to infect bootsectors of diskettes. The Virus could only be distributed by executing an infected file from floppy or by copying an infected file to diskette. Similarities........: Virus in Flip strain Known Variant.......: Flip.2153 Virus 1) Length on media: 2153 Bytes 2) Length in memory: 2672 Bytes --------------------- Agents ------------------------------------------ Countermeasures.....: Various AntiVirus products detect Flip viruses. - dito - successful: --- Standard means......: --- --------------------- Acknowledgement --------------------------------- Location............: Virus Test Center, University of Hamburg, Germany Classification by...: Matthias Jaenichen Documentation by....: (Received from Russian author) Date................: 20-February-1993 Information Source..: Virus documentation ===================== End of FLIP Virus =============================== ======= Computer Virus Catalog 1.2: "Hey You" Virus (20-FEB-1993) ====== Entry.................: "Hey You" Virus Alias(es).............: 923, 928 Virus Virus Strain..........: --- Virus detected when...: February 1991 where...: Bulletin Board, Slovenia Classification........: Program (.COM, .EXE) infector, memory resident Length of Virus.......: 1) Length on media: 928 (3A0h) - 943 bytes 2) Length in memory: 944 bytes ---------------------- Preconditions ----------------------------------- Operating System(s)...: MS/PC-DOS Version/Release.......: 2.00 and upwards Computer model(s).....: All IBM PC compatibles ----------------------- Attributes ------------------------------------- Easy Identification...: Virus contains text (message displayed): "Hey, YOU !!! Something's happening to you ! Guess what it is ?! HA HA HA HA ..." Self identification...: System: infected if INT 21h function BBBBh returns value 6969h in AX-register. .COM files: checks if first byte of file is jump (E9h), calculates jump destination and then compares file contents at destination with first nine bytes of the virus. .EXE files: calculates entry point and compares file contents with first nine bytes of virus. Type of infection.....: System: Virus first checks MCB if there will be at least 64Kb available after installing itself in memory. It then copies itself at the top of available memory and decreases the value of available memory by 3Bh paragraphs (=944 bytes). Files: virus appends itself at end of .COM (including COMMAND.COM) and .EXE files, enlarging file size between 928 and 943 bytes. Files will only be infected once. Infection Trigger.....: Calling INT 21h (EXEC) function 4B00h Storage media affected: Files can be infected on all media (HD,FD) Interrupts hooked.....: INT 21h (functions 4B00h and BBBBh), INT 24h (only during infection of a file) Damage................: Permanent damage: --- Transient damage: When an infected program is executed, computer beeps (^G), displays the message described above (see: Easy Identification) and exits to DOS. Damage Trigger........: Transient damage: if during infection function GetDate returns with year>=1991 AND month>=2 AND day>=25 AND (Mem[0:46Ch] AND 7=0) (Real Time Clock). Particularities.......: INT 21h is set directly (not via DOS) and always points to xxxx:00B5h. EXE files with maximum memory requirement equal FFFFh paragraphs will not be infected. Attribute, time and date of an infected file remain unchanged. Read-only and hidden attributes do NOT protect against infection. Similarities..........: --- ----------------------- Agents ----------------------------------------- Countermeasures.....: F-Prot v2.02 recognizes the virus as "Hey You"; McAfee's Scan v80+ recognizes it as "923 virus [923]", McAfee's Scan v89B recognizes it as "Generic Virus [GenF]". Countermeasures successful: Tested: F-Prot v2.03a detects and removes the virus. Standard means......: --- --------------------- Acknowledgement ---------------------------------- Location............: --- Classification by...: Dalibor Cerar Documentation by....: Dalibor Cerar Date................: 16-April-1992 Information Source..: (original virus analysis) ===================== End of "Hey You"-Virus =========================== ======= Computer Virus Catalog 1.2: Kampana Virus (20-FEB-1993) ======== Entry...............: Kampana Virus Alias(es)...........: Telefonica = Spanish Telecom Virus Virus Strain........: Kampana Virus Strain Virus detected when.: December 1990 where.: Spain Classification......: Program Virus: memory-resident, self-encrypting appending COM infector, stealth Length of virus.....: 1) Length on media: 3700 bytes 2) Length in RAM: 3700 bytes Variants............: --------------------- Preconditions ------------------------------------ Operating system(s).: MS-DOS Version/release.....: 2.0 and higher Computer model(s)...: All MS-DOS machines --------------------- Attributes --------------------------------------- Easy identification.: The following text can be found in memory: "Virus Anti - C.T.N.E. (c)1990 Grupo Holokausto.",0h, "Kampanya Anti-Telefonica. Menos tarifas y mas servicio.",0h, "Programmed in Barcelona (Spain). 23-8-90. - 666 -",0h Type of infection...: Self-Identification: The time stamp of an infected file is changedby adding 200 to actual year (19xx ==> 21xx); this will not be visible when virus is resident. When executing an infected file, virus will decrypt and install itself resident in memory. Subsequently, Kampana Boot Virus is installed on hard disk (see Kampana Boot). A previously non-infected .COM file is infected when virus is memory-resident by appending the viral code to it; small COM files (size<128) and large COM files (size>=61000 bytes) are not infected. Infection trigger...: Execution of a .COM-file (but not IBM*.COM or ??MAND*.COM), this is Storage media affected: Files on all media. (See boot-virus, too.) Interrupts hooked...: INT21h only. Damage..............: Permanent Damage: Kampana Virus overwrites HD boot sector with Kampana Boot. Damage trigger......: Permanent Damage: accessing a file on disk. Particularities.....: The virus ignores all attributes of a file. It encryptes itself in a file using two different techniques, including many changes of dummy bytes to reduce the length of scan strings; it looks for interrupts 13h, 21h, 40h to access BIOS and DOS directly; if file- length is looked for, virus displays original length of an infected file. --------------------- Agents ------------------------------------------- Countermeasures.....: Very difficult because of encryption and stealth! Countermeasures successful: --- Standard means......: FindViru, F-Prot and Scan (etc) --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, FRG Classification by...: Daniel Loeffler Documentation by....: Daniel Loeffler Date................: January 25, 1993 Information Source..: Reverse-Engineering of virus code ===================== End of Kampana-Virus ============================= ===== Computer Virus Catalog 1.2: Kampana Boot Virus (20-FEB-1993) ===== Entry...............: Kampana Boot Virus Alias(es)...........: Antitelefonica = Antitel Boot Virus Virus Strain........: Kampana Virus Strain Virus detected when.: Summer 1991 where.: Spain Classification......: Boot Virus, memory resident, stealth Length of virus.....: 1) Length in memory: 1024 bytes 2) Lenght on media: 1024 bytes = 2 sectors --------------------- Preconditions ------------------------------------ Operating system(s).: MS-DOS Version/release.....: 2.0 and higher Computer model(s)...: All MS-DOS machines --------------------- Attributes --------------------------------------- Easy identification.: Start of infected boot-sector contains empty entries (8*" ") as manufacturer-ID and DOS-ID. This is readable ONLY if booted from a clean disk. Type of infection...: Self-Identification: Word 9EBCh at offset 4Ah in the infected boot-sector (=location where the encrypted message starts) Hard disk #1 infected by Kampana file virus: boot virus is written to HD position at head 0, track 0, sector 1 and 6; the old boot sector is moved to sector 7. The virus will enter at top of memory during boot process and will intercept INT13h. Infection trigger...: Every access to a non-write-protected diskette will infect it (via INT 13h). Storage media affected: FD in drive A: and B: Interrupts hooked...: INT13h Damage..............: Permanent damage: virus writes garbage (from 0000:0000h) to all sectors on all floppy disk drives (or harddisks) many times. Transient damage: Virus displays the text: "Campa¤a Anti-TELEFONICA (Barcelona)",0ah,0dh Damage trigger......: Every 400th boot. Particularities.....: Virus intercepts INT13h to control any access to itself, so the original content is displayed. Changed content is displayed ONLY if booted from a clean disk. --------------------- Agents ------------------------------------------- Countermeasures.....: Very difficult because of encryption / stealth! Countermeasures successful: --- Standard means......: FindViru, F-Prot, Scan (etc) --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, FRG Classification by...: Daniel Loeffler Documentation by....: Daniel Loeffler Date................: January 25, 1993 Information Source..: Reverse-Engineering of virus code ===================== End of Kampana-Virus ============================= ==== Computer Virus Catalog 1.2: Minimal Virus Strain (20-Feb-1993) ==== Entry...............: Minimal Virus Strain..............: Minimal Virus Strain Classification......: All Minimal Viruses: Overwriting COM infectors, direct action; not memory-resident. Size of Viruses....... On media: various (see entries) =============================== Virus Entry#1......... Minimal.Psycho = Minimal.Hastings Virus Detected: when........ --- where....... --- Size of virus......... Length: 200 bytes (overwriting) ------------------------------- Virus Entry#2......... Minimal.Hanger Virus Detected: when........ --- where....... --- Size of virus......... Length: 143 bytes (overwriting) ------------------------------- Virus Entry#3......... Minimal.Banana Virus Detected: when........ --- where....... --- Size of virus......... Length: 139 bytes (overwriting) ------------------------------- Virus Entry#5......... Minimal.50 Virus Detected: when........ --- where....... --- Size of virus......... Length: 50 bytes (overwriting) ------------------------------ Virus Entry#6......... Minimal.46 = DeathCow Virus Detected: when........ --- where....... --- Size of virus......... Length: 46 bytes (overwriting) Variant............... Minimal.42 Size of virus......... Length: 42 bytes (overwriting) ------------------------------ Virus Entry#7......... Minimal.45.A = Shortest Virus Detected: when........ --- where....... --- Clones................ Minimal.45.B virus, Minimal.45.C virus Size of virus......... Length: 45 bytes (overwriting) Variant............... Minimal.35 Virus Size of virus......... Length: 35 bytes (overwriting) ------------------------------ Virus Entry#8......... Minimal.44 Virus Detected: when........ --- where....... --- Length of virus....... Length: 44 bytes (overwriting) ------------------------------ Virus Entry#9......... Minimal.39 Virus Detected: when........ --- where....... --- Length of virus....... Length: 39 bytes (overwriting) Variant............... Minimal.38 Virus Length of virus....... Length: 38 bytes (overwriting) ------------------------------ Virus Entry#10........ Minimal.31.A Virus Detected: when........ --- where....... --- Clone................. Minimal.31.B = Miniscule Virus Size of virus/clone... Length: 31 bytes (overwriting) ------------------------------ Virus Entry#11........ Minimal.30.A Virus Detected: when........ --- where....... --- Clones................ Minimal.30.B, Minimal.30.C Virus Size of virus/clones.. Length: 30 bytes (overwriting) ------------------------------ Virus Entry#12........ Minimal.25 Virus Detected: when........ --- where....... --- Length of virus....... Length: 25 bytes (overwriting) Variant............... Minimal.26 Virus Length of virus....... Length: 26 bytes (overwriting) ---------------------- Preconditions --------------------------------- Operating System(s)... MS/PC-DOS 3.x upwards Computer models....... All IBM PC/AT compatibles ---------------------- Common Attributes of Strain Viruses ----------- Easy identification... Infected files will not run as they are over- written by the resp. virus; only virus code will be executed, and system will then crash. Type of infection..... Self-identification: none (just overwriting) COM files: not increased, unless infected file is shorter than virus. Files can only be infected when an infected host is started; first bytes of infected file (length depending on virus/variant) will be overwritten by virus. EXE files: no infection. Infection trigger..... Any time an infected file is run, the viruses infects one or all .COM files in the current directory. Affected media........ Files on HardDisk or any FloppyDisk. Interrupts hooked..... --- Damage................ Permanent damage: infected file is overwritten. Damage trigger........ Execution of an infected file. Particularities....... The file date/time will be set to the date of the infection. Similarities.......... In stepwise reduction of size, MINIMAL viruses aim at achieving the shortest code suitable for infection. Though probably different authors worked on the viruses, this common goal is explicitly mentioned in some texts. While early version contain several texts, later versions contain essentially code suf- ficient to infect files by overwriting them; but texts may be deposited in infected files at remote locations. Every virus in Minimal strain infects one or all *.COM or *.C* or *.* files in the current directory, by overwriting the first bytes of the files with itself. If the file to be infectes is smaller than the resp. virus, the file size will grow to the virus' size. ---------------------- Special Attributes of Minimal.Hastings ---------- Virus name............ Minimal.Psycho or Minimal.Hastings Size.................. 200 bytes Type of infection..... Infects the 1st .COM file in current directory by overwriting it. Easy identification... Texts found in virus at offset 40dez '*.COM by' (encrypted name deleted) 'AKA Nick Haflinger...' 'Zopy me I want' to travel' 'I can now program in assembler' 'This program was written in the town' 'of Hastings hehehehe!' ---------------------- Special Attributes of Minimal.Hanger ------------ Virus name............ Minimal.Hanger Virus Size.................. 143 bytes Type of infection..... Infects all *.C* files (*.COM, but also *.C) in current directory by overwriting them. Easy detection........ Infected files contain (unencrypted) message (see Transient damage) at offset 59dez. Damage................ Permanent damage: Overwriting infected files. Transient damage: After infection, virus displays the message: 'System Hanger! Enjoy! ' 'Note: Your system is now hanged.' 'Press Reset to continue.' Then systems may hang (HLT instruction) ---------------------- Special Attributes of Minimal.Banana ------------ Virus name............ Minimal.Banana Virus Size.................. 139 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. Easy identification... The following text is found in infected files at offset 80dez: 'BANANA, coded by Morbid Angel' '-92 in Stockholm/Sweden*.COM' Particularities....... Upon infection, file-attribute, time and date are saved and correctly restored. ---------------------- Special Attributes of Minimal.50 --------------- Virus name............ Minimal.50 Virus Size.................. 50 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. ---------------------- Special Attributes of Minimal.46 ---------------- Virus name............ Minimal.46 = DeathCow Virus Size.................. 46 bytes Type of infection..... Infects all *.COM files by overwriting the,. Variants.............. Optimized version is Minimal.42, Size.................. 42 bytes Easy identification... The following text is visible in infected files 'DeathCow, Strain B' '(C) 1991' 'Nowhere Man and [NuKE] WaErZ' 'Written by Nowhere Man, derived from' 'DeathCow (author unknown)' ---------------------- Special Attributes of Minimal.45 ---------------- Virus name............ Minimal.45.A = Shortest Virus Size.................. 45 bytes Type of infection..... Infects all *.COM files by overwriting them. Clones................ Minimal.45.B and Minimal.45.C (same size) Variants.............. Minimal.35 Virus Size.................. 35 bytes ---------------------- Special Attributes of Minimal.44 ---------------- Virus name............ Minimal.44 Virus Size.................. 44 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them ---------------------- Special Attributes of Minimal.39 ---------------- Virus name............ Minimal.39 Virus Size.................. 39 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. Variants.............. Minimal.38 Virus Size.................. 38 bytes Remark................ A slightly optimized version of Minimal.39 Virus ---------------------- Special Attributes of Minimal.35 ---------------- Virus name............ Minimal.35 Virus Size.................. 35 bytes Type of infection..... Infects one file with pattern *.C* by overwriting Easy identification... Infected files contain following unencrypted text 'Copyright (C) by Line Noise 1992' Remark................ A significantly optimized version of Minimal.45 ---------------------- Special Attributes of Minimal.31.A -------------- Virus name............ Minimal.31.A Virus Size.................. 31 bytes Type of infection..... Infects one file with pattern *.C* by overwriting ---------------------- Special Attributes of Minimal.31.B -------------- Virus name............ Minimal.31.B = Miniscule Virus Size.................. 31 bytes Type of infection..... Infects one file with pattern *.* by overwriting Easy identification... The following text is found in infected files 'Miniscule: the world's smallest' 'generic virus (only 31 bytes' 'long!) (C) 1992 Nowhere Man and' '[NuKE] WaReZ' 'Written on January' '22, 1991' ---------------------- Special Attributes of Minimal.30.A/B/C ---------- Virus name............ Minimal.30.A Virus Size.................. 30 bytes Type of infection..... Infects one file with pattern *.* by overwriting Variant#1............. Minimal.30.B Particularities....... Minimal.30.B overwrites 256 bytes of a file Remark................ Uses two different opcodes for same purpose Variant#2............. Minimal.30.C Virus Remark................ Some opcodes swapped, but 98% same code Particularities....... Minimal.30.C overwrites 30 bytes of a file ---------------------- Special Attributes of Minimal.25 --------------- Virus name............ Minimal.25 Virus Size.................. 25 bytes (or longer); infected file size will vary, due to some optimization in virus code, in the range of overwritten bytes 25 <= size <= 33049. Type of infection..... Infects one .COM file by overwriting Particularities....... Virus only works under specific conditions. Variants.............. Minimal.26 Virus Size.................. 26 bytes Type of infection..... Infects one *.* file Particularities....... As Minimal.25, this virus also works only under specific conditions ---------------------- Agents ---------------------------------------- Countermeasures....... Standard Means........ Notice file length and file date/time. Use ReadOnly attribute. Infected files can only be disinfected by replacing them with the original files. ---------------------- Acknowledgements ------------------------------ Location.............. Virus Test Center, University Hamburg, Germany Classification by..... Stefan Tode Documentation by...... Stefan Tode Date.................. 31-January-1993 Information source.... --- ====================== End of Minimal Virus Strain ==================== === Computer Virus Catalog 1.2: PS-MPC Virus Generator (20-FEB-1993) === Entry...............: PS-MPC Virus Generator Alias(es)...........: Phalcon-Skism Mass Produced Code Generator Virus Strain........: PS-MPC generated Viruses Virus detected when.: Summer 1992 where.: North America (USA) Classification......: Virus-Generator: creates Assembly Code for Non-resident File Infectors, optionally Self-encrypting. Length of Virus.....: Depends on creation options and infection routine --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS 4.0 and above Version/Release.....: Versions 0.90 á, 0.91 á Computer model(s)...: IBM & compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Variable self-identification Type of infection...: COM and EXE appending Infection Trigger...: Every INT 21 call in resident viruses Storage media affected: EXE and COM files are infected (v.0.90 á); COMMAND.COM may be infected (v.0.91 á) Interrupts hooked...: INT 21 all functions, (INT 24) Damage..............: To be written by oneself and linked to asm-code of generated code. Damage Trigger......: Various time-checks may be selected. Particularities.....: - Viruses decrease memory in high memory-area if resident. - Normally files in the current directory will be infected. It is possible to make the virus traversal (infects current directory and below) - Major Skeleton configuration options v.0.91 á: * Infection C(OM)/E(XE) * CommandCom (Yes/No): infect COMMAND.COM * Resident (Yes/No) * Traversal (same dir/subdirectories) * Residence Methods (Interrupt,Direct DOS manipulation,BIOS manipulation) * Encrypted (Yes/No) * IDWord (2 character:self-identification) * MinSize/MaxSize: minimum/maximum size of COM files to be infected * Infections#: max.number of infections * ErrorHandler: critical error handler for Abort,Retry,Fail messages * VirusName, AuthorName: strings * Activation Conditions: IfMonth,IfDay, IfYear,IfDayofWeek,IfMonthDay,IfHour, IfMinute,IfSecond,Percentage(counter) Similarities........: More than 20 viruses have appeared which have clearly been produced with this virus generator: 1) 203 Virus 2) 644 Virus 3) Abraxas Virus 4) ARCV Virus Strain ARCV-1 ,-2, -3, -4, -5, -6, -7, -8, -9 Remark: ARCV group has also produced viruses with TPE engine (see TPE strain) and developed the ARCV strain. 5) Joshua Virus 6) Kersplat Virus 7) McWhale Virus 8) Mimic Virus 9) Small_ARCV Virus 10) Small_EXE Virus 11) Swan_Song Virus --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: FindViru, F-Prot (etc) Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: University of Hamburg, Virus Test Center, Germany Classification by...: Holger Prescher Documentation by....: Holger Prescher Date................: 02-January-1993 Information Source..: Reverse-Analysis of Generator, Skeleton files. ===================== End of PS-MPC Virus Generator ===================== ======== Computer Virus Catalog 1.2: Techno Virus (20-FEB-1993) ======== Entry...............: Techno Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: December 1992 where.: Pforzheim, Germany Classification......: Direct action, Program (COM) Infector, appending. Length of Virus.....: 1.Length (Byte) on media: 1123-1138 Bytes 2.Length (Byte) in memory: --- --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Version >= 2.00 Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Infected Files contain two plain text strings near the end: "TECHNO", "Don't touch the keyboard". Type of infection...: Self-Identification on disk: (FILE[0]=E9) and (FILE[A]=78) and (FILE[C]=79) Appending file virus. The virus first tries to infect COMMAND.COM by checking for the COMSPEC entry in the environment and then does a find_first/next_loop on *.COM, which is limited by a timer to about 1.15 sec (probably to hide the activity). Infection Trigger...: Executing an infected file if Length of destination file is 10<=FileLength<61439. Storage media affected: COM files on HD/FD Interrupts hooked...: INT 1C and INT 24 are hooked; INT 10, INT 16 and INT 21 are used. Damage..............: Permanent Damage: --- Transient Damage: Displaying message, Techno music: Virus writes "TECHNO" all over the screen, while playing techno music. If a key is touched this is intercepted and the string "Don't touch the keyboard" is written instead. Finally it displays a box in the middle spelling in big letters the word "TECHNO". Damage Trigger......: Permanent damage: --- Transient damage: Executing an infected file will trigger a random number renerator with a 0.25% probability of triggering the transient effects (messages/music). Particularities.....: Limits the infection process to 1.15 sec to reduce the chance of being detected. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: 1) For detection, search for "TECHNO" and "Don't touch the keyboard" in COM files. 2) For removal: delete or overwrite infected files. --------------------- Acknowledgement ---------------------------------- Location............: Micro-BIT Virus Center, University of Karlsruhe Classification by...: Christoph Fischer Documentation by....: Christoph Fischer Date................: 28-December-1992 Information Source..: Reverse-engineering of Virus ===================== End of Techno Virus ============================== === Computer Virus Catalog 1.2: VCL Authoring Package (20-FEB-1993) ==== Entry...............: Virus Construction Language (VCL) Standard CARO name..: VCL Alias(es)...........: --- Virus Strain........: --- Virus detected when.: --- where.: --- Classification......: Virus Authoring Package: generates file (COM,EXE) infectors or trojans, depending on selection of options. They are generated in source code. Length of Virus.....: --- --------------------- Preconditions ---------------------------------- Operating System(s).: MS-DOS Version/Release.....: Version 2.x and above Computer model(s)...: IBM PC, XT, AT and higher, and compatibles --------------------- Attributes ------------------------------------- Easy Identification.: (depends on generated virus) Search string.......: (depends on generated virus) Type of infection...: EXE-files: Overwriting or Companion COM-files: Overwriting or Appending Infection Trigger...: (depends on generated virus) Storage media affected: (depends on generated virus) Interrupts hooked...: --- Damage..............: The following types of transient or permanent damage can be implemented in all classes of viruses and trojans generated: 1) Beep a desired amount of times. 2) Change size of RAM available under 1 meg. 3) Clear the screen. 4) Cold Reboot of the system. 5) Corrupt files, using a random encryption. 6) Disable a parallel prot. 7) Disable the Print Screen Key. 8) Disable a serial port. 9) Display a string on the screen. 10) Drop a program into a file. 11) Delete files. 12) Lock up the computer. 13) Send a value to a port. 14) Send random values to all ports. 15) Play a tune / Sound effects. 16) Send a string to the printer. 17) Switch to ROM BASIC (if available). 18) Send a string to a serial port. 19) Swap two parallel ports. 20) Swap two serial ports. 21) Trash one or more drives (starting with the highest drive). 22) Uncrunch and display a run-length encoded ANSI string. 23) Warm reboot. It is possible to implement any other routine as a transient or permanent damage. Damage Trigger......: Condition can be choosen from the following menu: 1) Country code (DOS). 2) Kind of CPU installed in the computer. 3) Day / Month / Year / Weekday. 4) DOS-version. 5) Ammount of EMS. 6) Number of floppy drives. 7) Number of game ports. 8) Hour / Minute / Second. 9) Number of prallel ports. 10) Amount of RAM. 11) Random. 12) BIOS rollover flag (indicates wether the computer has been on for 24 hours continu- ously or not) 13) Number of serial ports. 14) All files infected. 15) Is 4DOS installed? The condition can be choosen freely and the trigger may be set for all damages individually, responding to whether conditions are true,false, or relations (equal,bigger,lesser) hold. Various conditions can be combined. Particularities.....: 1) VCL Toolkit also offers the opportunity to build Trojans and Logic bombs with all possibilities as described above. 2) VCL Toolkit offers the feature to use encryption for Viruses and Trojans but not for Logic bombs. Encryption method is a simple XOR with variable key and 2 slightly different routines (use of di/si). 3) It is also possible to install a trace-stopper, but it should stop no longer than 5 min. 4) The infection rate of created viruses can also be modified. 5) Generated viruses can search their victims either in actual directory, all directory tree, path or only the first file, depending on the user. General comments....: It's not that easy, creating viruses with this tool as it may seem: most viruses generated with VCL have difficulties during assembly, and if they are successfully assembled they dont work in most cases. Similarities........: 1) Some parts of the code are stolen from various other sources. 2) Among others, the following viruses generated with VCL have appeared: CodeZero, Diarrhea, Diarrhea II, Diogenes, Donatello, Earth_Day, Enun, Kinison, Mimic, Pearl_Harbour, VMessiah, Venom, Yankee.A, Yankee.B The following trojan developped with VCL has appeared: Richards --------------------- Agents ------------------------------------------- Countermeasures successful: (depends on virus and AV product) Standard means......: Delete and replace infected files. --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Toralv Dirro Documentation by....: Toralv Dirro Date................: 25-February-1993 Information Source..: Original virus analysis ===================== End of VCL Virus Generator ======================== ======= Computer Virus Catalog 1.2: VOID_POEM Virus (20-FEB-1993) ====== Entry...............: VOID_POEM Virus Alias(es)...........: Poem Virus Virus Strain........: --- Virus detected when.: where.: South Africa Classification......: Memory-resident Program (COM) infector, appending. Length of Virus.....: 1.Length (Byte) on media: 1825 + 31 Bytes 2.Length (Byte) in memory: 1825 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Version >=3.10 Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: Self-Identification in memory: memw[0:1F0h] XOR memw[0:1F2h] = ACDCh Self-Identification on disk: file[last_byte-1] XOR D9h=file[last_byte] Infection Trigger...: Execution of a COM program with 580<=LengthCOM<=62464. Storage media affected: FD/HD Interrupts hooked...: INT 21h/4Bh, INT 21h/6Dh. Damage..............: Permanent Damage: Poem (the same one) written over LSN 1..1220 on drive C: Transient Damage: Long Poem (very adolescent!) displayed on screen; long text (not included here) encrypted. Side-effect.........: PC may hang due to direct residency. Damage Trigger......: Permanent Damage: IF Day=21 AND Month=12 Transient Damage: IF Day=21 AND Month<>12 AND counter=2112 Particularities.....: The poem printed by the virus states that it was written by "Marvin Giskard", the pseudonym of the person claiming to have written 10_Past_3.748. The poem is dedicated to "T"; 10_Past_3.789, a rework of .748, includes code to print the name "Therese". Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: Classification by...: Paul Ducklin Documentation by....: Paul Ducklin (CARObase) Klaus Brunnstein (conversion to CVC format) Date................: 1993-February-15 Information Source..: Reverse-engineering of virus ===================== End of VOID_POEM Virus =========================== ======= Computer Virus Catalog 1.2: V-Sign Virus (20-Feb.1993) ======= Entry...............: V-Sign Virus Standard CARO name..: V-Sign (.3F,.1F) Virus Alias(es)...........: Cansu = Sigalit Virus Virus Strain........: V-Sign Virus Strain Known Variants......: V-Sign.3F, V-Sign.1F Virus detected when.: Turkey where.: February 1992 Classification......: Boot sector and partition table infector, oligomorphic, memory resident Length of Virus.....: 1) Length on media: 38 bytes + 2 sectors 2) Length in memory: 2 kByte --------------------- Preconditions ---------------------------------- Operating System(s).: MS-DOS Version/Release.....: --- Computer model(s)...: IBM - PCs, XT, AT, upward and compatibles --------------------- Attributes ------------------------------------- Easy Identification.: Search string (hex pattern) with wildcards (?): 1272 FA?? ???? ???? ???? ???? ???? ??CD 1372 EAE9 A601 7698 Type of infection...: Upon booting from an infected diskette, the virus makes itself memory resident in highest available 2 kByte below 640 kByte; system space is decreased by 2,048 bytes. After that, virus hooks INT 13h and modifies the boot sector image in memory by restoring the 38 bytes previously overwritten; control is then transferred to the original boot sector. On a previously not-infected hard disk, memory resident virus will infect HD partition table on first HD access; moreover, boot sectors on any not write-protected diskette accessed during memory residence of virus will be infected. The second part of the virus body is located at different places, depending on the size of the infected medium: Track: Head: Sectors: Medium: 0 0 4-5 Hard disk 0 1 2-3 5.25" DD diskette 0 1 13-14 5.25" HD diskette 0 1 4-5 3.5" DD diskette 0 1 14-15 3.5" HD diskette Upon every infection, virus increments a counter; when Counter AND Mask=0, transient damage is triggered (see below). Self-identification: After intercepting all read/write operations, virus checks for an existing infection using 9876h marker. Infection Trigger...: Booting from an infected medium (floppy boot sector, HD partition table) Media affected......: Any hard disk and floppy diskette. Remark: due to a bug, all diskettes infected in drive B: will try to load the second part of the virus body from that drive and thus will be non-infective (except if you happen to have two infected diskettes of one and the same size and capacity in both drives during the bootstrap). When booting from such floppies, virus attempts to read 2 sectors from B: and, if unsuccessful, system hangs. Interrupts hooked...: INT 13h Crypto method.......: --- Polymorphic method..: V-Sign is oligomorphic (mild form of polymorphism), so it can be detected with a search string con- taining wildcards (see Search string). Oligo- morphism is generated in the 38 byte code. Damage..............: Permanent HD damage: upon HD infection, V-Sign saves 38 bytes of partition table in its code and overwrites Side 0, Cyl.0, Sector 1; moreover, it saves the rest of its code on Side 0, Cyl.0, Sectors 4+5. Partition table is NOT saved. Permanent FD damage: upon floppy infection, virus saves 38 bytes of floppy boot sector in its code and overwrites original bootsector; moreover, it saves the rest of its code in last 2 sectors of root directory (see remark). Original boot sector is NOT saved. Transient damage: dependent on trigger con- dition, the virus displays a block graphic showing a Victory sign; then, system hangs. Damage Trigger......: Permanent (HD,FD) damage trigger: overwriting action during infection process. Transient damage: triggered when Infection Counter AND Mask = 0; Mask differs between variants: Variant 3F: every 64th infection Variant 1F: every 32nd infection. Similarities........: Infection method similar to Stoned viruses Known variants......: 2 minor variants (clones) are known which differ in 1 mask containing either 1F or 3F. Particularities.....: --- --------------------- Agents ----------------------------------------- Countermeasures.....: McAfee Scan V95+, Skulason F-PROT 2.05+, Solomon FINDVIRU 6.02, IBM's VirScan 2.2.3A and VirX 2.5+ detect V-Sign (other scanners may also detect V-Sign but were not tested). Standard means......: 1) Boot from clean system; reconstruct 38 original boot sector bytes from virus analysis. 2) Use SYS to destroy virus; reformat diskette after COPYing essential files. 3) Use FDISK/MBR (DOS 5) to reconstruct MBR. --------------------- Acknowledgement -------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Klaus Brunnstein Documentation by....: 1) Fridrik Skulason: Virus Bulletin July 1992 2) David Chess, IBM High-Integrity Computing Lab 3) Patty Hoffman VSUM (October 1992/with errors) Date................: 22-December-1992 ===================== End of V-Sign Virus ============================ ========= Computer Virus Catalog 1.2: V163 Virus (20-FEB-1993) ========= Entry...............: V163 Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: January 1993 where.: Zeuthen, Germany Classification......: Memory-resident Program (COM) Infector, Appending Length of Virus.....: 1.Length (Byte) on media: 163 Bytes 2.Length (Byte) in memory: 163 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: All versions Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: All files without an EXE-Header (MZ) will grow by 163 bytes and will have a 'M' as first byte followed by a intra segment jump (E9h). Type of infection...: Self-Identification in memory: [0000:0086]=60 Self-Identification on disk: FILE[0]=4D ='M' File infection: Appending file virus. The virus infects all files that do not contain an 'M' as first byte. Infection Trigger...: Executing a file. Storage media affected: HD/FD Interrupts hooked...: INT 21/4B Damage..............: Permanent Damage: --- Transient Damage: --- Damage Trigger......: Permanent Damage: --- Transient Damage: --- Particularities.....: 1) Does not bypass the R/O-flag of files. 2) Uses the DOS data area at 60:00 to 60:A2 to go resident; this will not always work! 3) Newer EXE-headers like NE or LE will not be handled, thus these files will be damaged! 4) Virus doesnot properly self-recognize itself in memory; anything resident process hooking INT21 will cause the virus to become resident again! Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: 1) Detection: COM files grow by 163 bytes. 2) Removal: Delete or overwrite infected files. --------------------- Acknowledgement ---------------------------------- Location............: Micro-BIT Virus Center, University of Karlsruhe Classification by...: Christoph Fischer Documentation by....: Christoph Fischer Date................: 18-Febuary-1993 Information Source..: Reverse-Engineering of virus code ===================== End of V163 Virus ================================ ===== Computer Virus Catalog 1.2: Butterflies Virus (31-July-1993) ===== Entry...............: Butterflies Virus Alias(es)...........: Goddam Butterflies Virus Virus Strain........: --- Virus detected when.: 1993 where.: Germany Classification......: File Virus (direct action COM Infector) Length of Virus.....: --------------------- Preconditions ----------------------------------- Operating System(s).: MS-DOS Version/Release.....: Releases >= 3.2 Computer model(s)...: IBM and compatibles --------------------- Attributes -------------------------------------- Easy Identification.: 1) COM Files contain following text strings: "Goddamn Butterflies" and "*.COM" 2) 4th Byte of an infected COM file: 01h. Type of infection...: 1) When executing an infected COM-file, virus will search for up to 4 uninfected COM-files to which it appends it's code. 2) When searching for victims, findfirst/findnext is used; therefore, normaly only COM-files in current directory are infected. If DOS append or similar programs are used, victims in other directories will be found also. Infection Trigger...: 1) Executing an infected program. 2) No infection, if COM filesize < 121 Bytes or COM filesize > 64768 Bytes. Storage media affected: Any disk/diskette Interrupts hooked...: --- Damage..............: No permanent or transient, except modifying COM-Files. Damage Trigger......: --- Particularities.....: 1) Does not infect COMMAND.COM or any other file, with "ND" at same position (6th and 7th character) in name. 2) In some parts of a South German forest, there was a recent invasion of butterfly-larvae with much public attention; this virus may reflect this event. Similarities........: --- --------------------- Agents ------------------------------------------ Countermeasures.....: Countermeasures successful: (no successful detection yet: July 1993) Standard means......: Delete infected files and restore from a clean source. --------------------- Acknowledgement --------------------------------- Location............: Virus-Test-Center, University Hamburg, Germany Classification by...: Torsten Dargers, Morton Swimmer Documentation by....: Torsten Dargers Date................: 31-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Butterflies Virus ======================== ===== Computer Virus Catalog 1.2: Chinese_Fish Virus (31-July-1993) ==== Entry...............: Chinese_Fish Virus Alias(es)...........: Fish Boot Virus Virus Strain........: --- Virus detected when.: Early 1992 where.: --- Classification......: Memory-resident System (MBR,FBR) infector. Length of Virus.....: 1.Length (Byte) on media: 1527 bytes (3 sectors) 2.Length (Byte) in memory: Does not reserve memory --------------------- Preconditions ------------------------------------ Operating System(s).: DOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: Self-Identification in memory: --- Self-Identification on disk: BR[B3h] = 2015h System infection: MBR infected at bootup from infected floppy. Virus + ORG.MBR saved at sec 8-10, cyl 0, head 0. FBR infected when accessed from infected system. Virus + ORG.MBR saved at the following: 1.44 MB = sec 11-13, cyl 79, head 0 720 KB = sec 01-03, cyl 79, head 0 1.2 MB = sec 01-03, cyl 79, head 0 360 KB = sec 01-03, cyl 39, head 0 Infection Trigger...: Reading or writing HD or FD after booting from infected system or floppy. Storage media affected: HD and FD Interrupts hooked...: INT 13h Damage..............: Permanent Damage: On Harddisk: Sec 8-10, cyl 0, head 0 on HD is overwritten with virus code and ORG.MBR. This is usually non-fatal as these sectors are unused on most machines. On floppy: Sec Cyl Head 1.44 MB = 11-13, 79, 0 720 KB = 01-03, 79, 0 1.2 MB = 01-03, 79, 0 360 KB = 01-03, 39, 0 These sectors may be in use if floppy is nearly full. Recovery of overwritten sectors is almost impossible. Transient Damage: Since virus does not reserve any memory for itself, it can easily be over- written after or during startup of machine. If virus is overwritten, machine will crash on next INT 13h issued as virus INT 13h handler no longer exists. When trigger conditions hold, the following message will be displayed black on white in the upper right corner of the screen: "Hello! I am FISH, please don't kill me. Congratulate 80th year of the Republic Of China Building,Fish will help to kill stone Written by Fish in NTIT. TAIWAIN 80.10.18" Damage Trigger......: Permanent Damage: Reading/writing HD or FD after booting from infected system or floppy. Transient Damage: Text message displayed on every INT 13h issued the 1st, 11th, 21st and 31st of any month during 1992 (uses INT 1Ah). Particularities.....: 1) Leaves start of FBR alone, and plays by the rules, making it hard to detect with heuristic scanning. 2) Does not reserve the memory it uses. 3) Extensive checking for both itself and the Stoned.Michelangelo virus. Making it possible for Chinese_Fish to survive if both viruses infects the same media. Stoned.Michelangelo will always be overwritten by Chinese_Fish, so the virus works like an anti-Michelangelo program, spreading from machine to machine, eradicating Stoned.Michelangelo whereever it comes across it. 4) Redirects attempts to read or write sectors where rest of virus + ORG.MBR are stored, as well as the usual redirection of MBR requests. Similarities........: --- Stealth techniques..: HD: Gives sec 11, cyl 0, head 0 on read or write requests for sectors 8-10, cyl 0, head 0. And sec 10, cyl 0, head 0 on read or write requests for sec 1, cyl 0, head 0 (MBR). FD: Gives original FBR on requests for boot sector containing virus. --------------------- Agents ------------------------------------------- Countermeasures.....: F-PROT 2.07 can be used to detect/verify infection Standard means......: FDISK/MBR after booting from certified virus free system diskette will disinfect harddisk. --------------------- Acknowledgement ---------------------------------- Location............: The University of Trondheim The Norwegian Institute of Technology Faculty of Electrical Engineering and Computer Science Classification by...: Henrik Stroem, Stroem System Soft Documentation by....: Henrik Stroem, Stroem System Soft Date................: 17-April-1993 Information Source..: Reverse-Engineering of virus code ===================== End of Chinese_Fish Virus ======================== ======= Computer Virus Catalog 1.2: Clone Virus (31-July-1993) ========= Entry...............: Clone Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: Spring 1993 where.: Sydney, Australia Classification......: File virus (EXE companion), memory resident. Length of Virus.....: 1.Length (Byte) on media: 833 Bytes (companion) 2.Length (Byte) in RAM: --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Companion file contains following text at the end: "Your PC is Cloned!! Clone Virus ver 2.0 .. (c) Cataclysm 1992 Sydney, Australia ....To Create and Mutate...." Type of infection...: File infection: Upon executing an infected EXE file (precisely: it's hidden COM companion of same name), virus "infects" EXE files by crea- ting a COM file with same name, 833 bytes long, with hidden, system and read only attributes. Self-Identification in file: once in memory, virus intercepts all Int 21 calls with AH = 4B (Load & Execute), 4E (Find First) and 4F (Find Next). Whenever an EXE file is loaded, a com- panion file is first created (if not already present). Whenever a call to 4E or 4F finds a COM file, it checks if file is one of its companion files; if so, it simply repeats the call until an uninfected file is found. Stealth: By hooking on INT 21 calls Load&Execute, FindFirst and FindNext, used by many utilities e.g. DIR and scanners, virus will not be de- tected by such methods. System infection: virus uses an undefined DOS call to INT 21, to see if it's already in memory; when not yet in memory (=given value in INT 21 register), virus hooks INT 21 and makes itself memory resident. Self-Identification in memory: Checks INT 21 functions 4B (Load&Execute), 4E (FindFirst) and 4F (Find Next) register for given value. Infection Trigger...: Running an infected EXE file (i.e. file with companion virus) Storage media affected: Interrupts hooked...: INT 21 functions 4B (Load & Execute), 4E (Find First) and 4F (Find Next) Damage..............: Because of the way COMMAND.COM searches for pro- grams, the hidden .COM files will be run in- stead of user's specified program. Companion will execute it's intended function (see Tran- sient Damage) and subsequently load and start the user's intended "original" program. Permanent Damage: no intended permanent damage. Transient Damage: On trigger condition, following text will be displayed: "Your PC is Cloned!!" Damage Trigger......: Permanent Damage: --- Transient Damage: If Date = April 1st. Particularities.....: --- Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: AntiVirus programs Countermeasures successful: VET 7.3 (CYBEC); no other products tested Standard means......: Boot from a clean diskette; use proper tool to change Read-Only attribute and delete companion COM file --------------------- Acknowledgement ---------------------------------- Location............: CYBEC Pty, Hampton Victoria/Australia Classification by...: Roger Riordan (riordan.cybec@mhs.oz.au> Documentation by....: Roger Riordan Klaus Brunnstein (CVC entry) Date................: 31-July-1993 Information Source..: Analysis of Virus ===================== End of Clone Virus =============================== ======= Computer Virus Catalog 1.2: Dudley Virus (31-July-1993) ======== Entry...............: Dudley Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: where.: Classification......: Polymorphic File (COM,EXE) Infector,Memory resident Length of Virus.....: 1.Length (Byte) on medium: 1153 Bytes (mod 16) 2.Length (Byte) in RAM: 4608 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: None (polymorphic) Type of infection...: Self-Identification methods: File infection: infects COM and EXE files by appending itself. Self recognition in files: virus checks whether EXE_Checksum5045h or COM_start==7100h. System infection: becomes memory resident by TWIXT method. For self-recognition in memory, virus checks for a specific content in AX register upon invocation of INT 21. Infection Trigger...: Special values in registers upon INT 21 execution Storage media affected: Interrupts hooked...: INT 21 functions 4B00h, 3Dh, 56h, 6Ch, 5454h Damage..............: Permanent Damage: none Transient Damage: none Damage Trigger......: Permanent Damage: none Transient Damage: none Particularities.....: 1) Virus contains a text which is not displayed: "<[Oi Dudley!][PuKE]>" 2) Virus contains code that attempts to avoid infecting a file with name ????SC??.???, but it has a bug. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Not tested Countermeasures successful: Not tested Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: IBM High Integrity Computing Lab, Hawthorne N.Y. Classification by...: David Chess, HICL Documentation by....: David Chess (CAROBase entry) Klaus Brunnstein, VTC Hamburg (Virus Catalog) Date................: March 10, 1993 Information Source..: Reverse analysis of virus code ===================== End of Dudley Virus ============================== ======== Computer Virus Catalog 1.2: F-Word Virus (13-Feb-1993) ======== Entry...............: F-Word Virus Alias(es)...........: Fuck You Virus Virus Strain........: --- Virus detected when.: January 1993 where.: Italy Classification......: Program Virus: COM infector, direct action Length of Virus.....: 383 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS, PC-DOS Version/Release.....: Computer model(s)...: IBM PC/XT/AT and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Infected files contain strings "FUCK YOU", "*.COM" Type of infection...: Extends .COM files by replacing first 5 bytes with a portion of the viral code, then extends program by adding rest of code to end of file. Original 5 Bytes will be stored at the end of an infected file. Infection Trigger...: Execution of an infected file. Storage media affected: .COM files Interrupts hooked...: --- Damage..............: Damage Trigger......: Particularities.....: --- Similarities........: --------------------- Agents ------------------------------------------- Countermeasures.....: Only Skulason's F-Prot with "Heuristic scan" detects infection (but the alert message is wrong!) --------------------- Acknowledgement ---------------------------------- Location............: Laboratorio per l'Analisi dei Virus Informatici, Rome Classification by...: Luca Sambucci Documentation by....: Luca Sambucci Date................: February 13, 1993 Information Source..: --- ===================== End of F-Word Virus =============================== ======== Computer Virus Catalog 1.2: GNAT Virus (31-July-1993) ========= Entry...............: GNAT (1.0) Virus Alias(es)...........: --- Virus Strain........: Virus detected when.: July 1993 where.: Germany Classification......: File virus (EXE infector),memory resident,stealth Length of Virus.....: 1.Length (Byte) on media: 756-771 Bytes 2.Length (Byte) in RAM: 832 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: "0103h" in bytes 20-21 of infected files (see Self- Identification in files). Type of infection...: File infection: After virus became memory resident, EXE and ZM files are infected upon Trigger conditions (see below) by appending virus code. Self-Identification in files: Virus tests if (file[0014h] = 03h) AND (file[0015h] = 01h) {EXE-IP = 0103h} System infection: Upon execution of an infected file, virus makes itself memory resident (using TWIXT method). Self-Identification in memory: Virus tests if memw[0000h:0086h] > 0350h {SEG(INT 21) > 0350h} Infection Trigger...: If (Exec OR Load w/o Exec) AND (memw[0000h:004Eh] <= 0300h){SEG(INT 13)<=0300h} AND (file[4] >= 1) {Length>=512} AND (file[4] = ((Length SHR 9)+(1; IF Length MOD 512 = 0))) Storage media affected: Interrupts hooked...: INT 1C, INT 21/4B00, INT 21/4B02, INT 24 (while in INT 21 ISR). Damage..............: Permanent Damage: --- Transient Damage: Virus mirrors screen horizontally and vertically. Damage Trigger......: Permanent Damage: --- Transient Damage: If (Date = October 11) AND (BIOS_timer_low = 0FFFFh) AND at least one new infection at this day. Particularities.....: 1) Virus is encrypted,with variable key stored in- side decryption routine (form of polymorphism); en/decryption key is low byte of new CS value in EXE-file-header. 2) Virus contains encrypted string: "GNAT 1.0". 3) Stealth methods: virus sets file r/w for in- fection and restores original file attribu- tes, date and time after infection; hooks interrupts by direct memory access; while running the INT 21h ISR, virus temporarily stores the INT 21 vector saved on infection back to IVT; uses slightly self modifying code; no TSR-call, just jumps to original program at virus' end. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University of Rostock, Germany Classification by...: Dirk Haratz (dharatz@informatik.uni-rostock.de) Documentation by....: Dirk Haratz Klaus Brunnstein (CVC entry) Date................: 24-July-1993 Information Source..: Reverse analysis of virus code ===================== End of GNAT Virus ================================ ======== Computer Virus Catalog 1.2: Horns Virus (31-July-1993) ======== Entry...............: Horns Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: where.: Classification......: File virus (appending AVR infector),stealth, memory resident Length of Virus.....: 1.Length (Byte) on storage medium: 624 Bytes 2.Length (Byte) in RAM: 896 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Virus code contains message (not displayed): "[Horns Of Jericho (c) 92 Crom-Cruach/Trident]" Type of infection...: Appending AVR file infector: virus infects .AVR files opened for read-only when file is being closed. Virus appends itself (624 bytes) to end of an infected file and recalculates .AVR specific checksum to bypass AVR integrity check. Remark: AVR format is COM-like, but starts at offset 0000h rather than 0100h; an AVR file is loaded to XXXX:0000, where XXXX is ar- bitrary segment. Module's entry point is at offset +48h. Self-identification in file: File[0x48] = 0xE9 SELFREC_IN_MEMORY: INT_21;AX=44A0 -> AH=FF System infection: upon execution of an infected file, virus makes itself memory resident using TWIXT method. Self-identification in memory: special content of register upon INT 21 invocation. Infection Trigger...: Infection occurs when the following conditions hold: (Open for Read-Only + Close) AND FileName[0..1]=='C:' AND FileExt=='.AVR' AND File[0x48] != 0xE9 AND File[0x41..0x43]==0x000100 AND (File[0x3c..0x3d] & 0xf)==0 Storage media affected: Virus infects only files on disk drive C: Interrupts hooked...: INT 21 (functions 3D00, 3E, 44A0) Damage..............: Permanent Damage: none (except infection) Transient Damage: An infected AVR module will report correct result (whether a file being scanned is infected or not) with a probability 1/4. In 3/4 of cases, it will report "not infected" regardless on actual state. IN FACT, due to a bug, an infected .AVR will always report "not infected". Damage Trigger......: (BIOS_TIMER_TICKS & 03) != 0 Particularities.....: 1) Stealth method: Recalculates the AVR checksum for an infected file, to undergo AVR integrity check. 2) Virus is distributed by dropper HORNS.COM. 3) AVR file format was used some time ago by some scanners (e.g. TBScan) but is no longer used. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: None (at publication time) Standard means......: Delete infected file, replace with clean file. --------------------- Acknowledgement ---------------------------------- Location............: Program Systems Institute, Russian Academy of Sciences, Pereslavl-Zalessky, Russia Classification by...: Dmitry O. Gryaznov Documentation by....: Dmitry O. Gryaznov Klaus Brunnstein (VTC, Virus Catalog entry) Date................: 21-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Horns Virus =============================== ====== Computer Virus Catalog 1.2: Invisible Virus (31-July-1993) ====== Entry...............: Invisible Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: Spring 1993 where.: Italy Classification......: System (MBR) and File (COM,EXE) Infector, memory resident, slightly tunnelling Length of Virus.....: 1.Length (Byte) on storage medium: 1a. Length in COM files: 2926 Bytes 1b. Length in EXE files: 2926+15 Bytes 1c. Length of MBR: 7 sectors. 2.Length (Byte) in RAM: 2a. when loaded from file: 3456 bytes 2b. when loaded from MBR: 4096 bytes. --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: File infection: virus infects COM and EXE files if the normal way (appending). Self-Identification in file: checksum of entrypoint. System infection: virus makes itself memory resident, using TWIXT method when loaded from a file, or TOP when loaded by MBR. Self-Identification in memory: virus checks for specila value in INT 21 register. Infection Trigger...: Executing, opening, renaming or mode changing a COM or EXE file; virus avoids certain files by doing a checksum on the name. Storage media affected: Infects MBR on disks, and COM or EXE files on disk or diskette. Does NOT infect floppy boot records. Interrupts hooked...: INT 21 (functions 2521,3521,4B00,3D,43,56,1C) (during boot from infected MBR only, later unhooked) Damage..............: Permanent Damage: Overwrites some files instead of infecting. The replacement code displays some song lyrics (see below) and plays noise on the speaker. Transient Damage: Virus plays some noise on the speaker. Trojanized files display message: "I'm the invisible man, I'm the invisible man, Incredible how you can See right through me. I'm the invisible man, I'm the invisible man, It's criminal how I can See right through you." This text is encrypted in virus, but not in Trojanized files. Damage Trigger......: Permanent Damage: Complex and pseudo-random, but becoming more likely with time-since-infection. Transient Damage: Execution of trojanized file. Particularities.....: 1) Not stealth, and only slightly tunnelling in attempting to hide INT 21 being intercepted. 2) Mildly polymorphic both on files and MBR. 3) Virus contains the following text which is NOT displayed: "The Invisible Man - Written in SALERNO (ITALY), October 1992. Dedicated to Ester: I don't know how or when, but I will hold you in my arms again.". Text encrypted. INTERRUPTS_HOOKED: 21/2521, 21/3521, 21/4B00, 21/3D, 21/43, 21/56, 1C (during boot from infected MBR only, later unhooked) Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: IBM High Integrity Computing Lab, Hawthorne N.Y. Classification by...: David M. Chess, IBM HICL Documentation by....: David M. Chess, IBM HICL Klaus Brunnstein (VTC, Virus Catalog entry) Date................: 31-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Invisible Virus =========================== ===== Computer Virus Catalog 1.2: Involuntary Virus (31-July-1993) ===== Entry...............: Involuntary Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: 1992 where.: USA Classification......: File and System virus (EXE, SYS infector), encrypted, sometimes memory resident Length of Virus.....: 1.Length (Byte) on media: 14xx bytes (see text) 2.Length (Byte) in RAM: --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: 1) No simple scan string is available for EXE files due to the encryptive nature of the beast (but 24 bytes of the decryptor seem to be constant, only filled with variable number of NOPs) 2) In memory (INT 21h handler) and SYS files, you can check for the following string: 3d 00 4b 74 03 e9 45 02 50 53 52 1e 06 b8 02 3d cd 21 73 03 Type of infection...: File infection: Upon infection (by appending virus' code), program entry is modified to point to the virus decryption code. File size will grow by 14xx bytes; size change can be observed with a DIR command (no stealth attempt made by virus). When virus first activates, it will try to read C:\CONFIG.SYS file and look for device drivers to infect. It checks EXE victims fo 'MZ' sig- nature, not for extension; therefore, any pro- gram loaded via 4B00 not having MZ signature is infected. File access during infection is via handle- oriented DOS functions. If victim is write- protected, it will NOT be infected since virus does not attempt to clear the file attribute if a request to OPEN for READ/WRITE fails. Self-Identification in files: Virus avoids multiple infections by checking: if difference between SS and SP fields in EXE header is =5Ch, then it assumes file already to be infected; otherwise, file will be infected now. System infection: Virus becomes memory resident when activated from a device, but when in an EXE file, it functions as a non-resident SYS infector. When running an infected EXE, it looks around for SYS files to infect, but does not go resident. When booting with an infected SYS file in CONFIG.SYS, it goes resident and infects EXE files that are executed. Self-Identification in memory: ? Infection Trigger...: Execution of infected EXE files or booting from an infected SYS (see System infection). Storage media affected: Disks Interrupts hooked...: INT 21h via direct access to IVT; checks for AX = 4B00, LOAD/EXEC request. Damage..............: Permanent Damage: 1) On trigger conditions (see below), virus displays following message: "You have helped spread this virus This has been a message from your friendly neighborhood infection service. Thank you for your involuntary cooperation." 2) When having displayed the message, virus will overwrite the first 10 sectors of first FAT on C: using INT 26h (absolute disk write). Transient Damage: --- Damage Trigger......: Permanent Damage: 14th day of every month Remark: David Chess reports a variant with trigger date = 19th any month. Transient Damage: --- Particularities.....: 1) This virus uses a crude 16-bit XOR type encryp- tion routine to evade identification. Encryp- tion key is obtained from BIOS timer (low word only). The decryption loop contains a bunch of NOPs for confusion. The general routine used for encryption is fixed; virus does not qualify for fully polymorphic. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: VDS Advanced Research Group, Baltimore, Maryland Classification by...: Tarkan Yetiser Documentation by....: Tarkan Yetiser (in Virus-L: August 26, 1992) David Chess IBM HICL (in Virus-L: Sept.2, 1992) Klaus Brunnstein (CVC entry) Date................: 31-July-1993 Information Source..: Virus-L (see authors) ===================== End of Involuntary Virus ========================= ========= Computer Virus Catalog 1.2: Junior Virus (31-July-1993) ====== Entry...............: Junior Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: July, 1992 where.: Sofia, Bulgaria Classification......: Memory resident, appending, COM file infector Length of Virus.....: 234 bytes --------------------- Preconditions ------------------------------------ Operating System(s).: PC/MS-DOS. Uses several undocumented and version- dependent tricks. Does not work under DR-DOS. Version/Release.....: Works under PC-DOS 3.30. Haven't checked for other versions. Computer model(s)...: Any MS-DOS computer --------------------- Attributes --------------------------------------- Easy Identification.: --- Self Identification.: The first instruction of infected files is a JMP which points at 56 bytes before end of file. Type of infection...: Any executable file, the first 2 bytes of which are not 'MZ' or 0C4h. Virus is appended to file. Infection Trigger...: Execution of a file. Storage media affected: Any storage media with MS-DOS compatible file system. Interrupts hooked...: INT 78h, 21h, 24h (only during infection), INT 13h (only during infection, and only if it is not already intercepted). Damage..............: --- Damage Trigger......: --- Particularities.....: The virus traps INT 21h/AX=4B00h in a very unusual way. It puts an INT 78h instruction at TerminateAddress-2 and intrcepts INT 78h itself. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Any up-to-date scanner; any integrity checker. Monitoring programs which trap only INT 13h may not be able to detect the virus. Countermeasures successful: --- Standard means......: Delete infected files, restore clean copies. --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University of Hamburg, Germany Classification by...: Vesselin Bontchev Documentation by....: Vesselin Bontchev Date................: 10-August-1992 Information Source..: Reverse analysis of virus code ===================== End of Junior Virus ============================== ====== Computer Virus Catalog 1.2: Last-Year Virus (31-July-1993) ====== Entry...............: Last-Year Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: where.: Classification......: File virus(appending COM infector),memory resident Length of Virus.....: 1.Length (Byte) on storage medium: 604 Bytes 2.Length (Byte) in RAM: 880 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: Self-Identification methods: File infection: infects COM files by appending it's code. For self-identification, tests whether 4th and 5th byte is "88 31". System infection: virus makes itself memory resident via TWIXT method. For self-identi- fication, virus checvks whether 2 bytes before the byte that the INT21 vector points to are "61 6D". Can therefore load more than once if another INT21-hooker intervenes. Infection Trigger...: Finding an executable file and if DS:DX ends in "COM". Storage media affected: Interrupts hooked...: Int 21: functions 4B, 0A, 2A Damage..............: Permanent Damage: none Transient Damage: INT21 handler subtracts one from the year on INT21/2A (Get Date) calls. Damage Trigger......: Permanent Damage: none Transient Damage: Always Particularities.....: 1) No side effects, except transient damage and usual MCB-munging due to TWIXT method. 2) Virus code is rather explicit in handling (ignoring) write-protect errors in INT 24 handler but coding of INT 21 handler shows some unused flag; potentially more variants are intended. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Not tested Countermeasures successful: Not tested Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: IBM High Integrity Computing Lab, Hawthorne N.Y. Classification by...: David Chess, IBM HICL Documentation by....: David Chess, IBM HICL (CAROBase entry) Klaus Brunnstein, VTC (Virus catalog entry) Date................: June 24, 1993 Information Source..: Reverse analysis of virus code ===================== End of Last-Year.604 Virus ======================= ====== Computer Virus Catalog 1.2: Little_Red Virus (31-July-1993) ===== Entry...............: Little_Red Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: Summer 1993 where.: Sydney University, Australia (presumably Chinese origin) Classification......: File virus (COM,EXE infector), memory resident, limited stealth, partly encrypted Length of Virus.....: 1.Length (Byte) on media: 1465 Bytes 2.Length (Byte) in RAM: --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Type of infection...: File infection: Virus infects all files loaded by DOS function 4B ("Load & Execute"), and one COM or .EXE file on each DIR command. Virus in- creases length of infected files by 1465 bytes. This increase in length is hidden from DIR, but programs which use DOS functions 4E & 4F will reveal the change in length. Top of memory is set down from A000 to 9F30. Encryption: two small sections of virus are en- crypted, using a fixed key (easy to detect). Self-Identification in file: System infection: upon starting an infected file, virus makes itself memory resident. Self-Identification in memory: virus uses DOS function 30 (get version) for self-recognition, and returns a particular value if resident. Infection Trigger...: Starting an infected program. Storage media affected: Disk Interrupts hooked...: Damage..............: Permanent Damage: No intended permanent damage. Side effects: during test, author experienced damage of COMMAND.COM, thus preventing booting. Transient Damage: no visible messages, but virus contains 2 tunes, with separate trogger: 1) A song named after the town where Mao Tse Tung was born, and 2) a Chinese patriotic song called Dong Fong Hong (or Mao's song); 3) Virus slows systems (disk activities). Damage Trigger......: Permanent Damage: --- Transient Damage: Both tunes are played on a given day, from 1994 onward, starting one hour after virus' activation and then played continously. Date trigger conditions: 1) Tune #1 played on each December 26, from 1994 onward; this is Mao's birthday where it is traditionally sung in China; 2) Tune #2 is played on September 9th, from 1994; on this day, Mao died. Particularities.....: Virus author has gone to some trouble to try to make virus inconspicuous until Sept 1994, but the decision to check files accessed by DOS functions 11 & 12 (the old style Find first and find next, used by DIR) causes obvious additional disk activity. In a test on an XT, it took over 5 secs to do a DIR of a disk with 21 files, all infected, whereas this took only 2.1 secs when virus was not active. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: CYBEC Pty, Hampton Victoria/Australia Classification by...: Roger Riordan (riordan.cybec@mhs.oz.au> Documentation by....: Roger Riordan Klaus Brunnstein (CVC entry) Date................: 31-July-1993 Information Source..: Analysis of Virus ===================== End of Little Red Virus ========================== ======== Computer Virus Catalog 1.2: Loren Virus (31-July-1993) ======== Entry...............: Loren Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: Summer 1993 where.: Australia (high school) Classification......: File virus (COM,EXE infector), memory resident Length of Virus.....: 1.Length (Byte) on media: 1387 Bytes 2.Length (Byte) in RAM: --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Type of infection...: File infection: virus infects .COM & .EXE files, increasing length by 1387 bytes, by appending itself to the end of the file; first 5 bytes of COM files are saved, and replaced with a jump to the virus, followed by a signature. It in- fects all files opened for execution, and all COM & EXE files referenced by INT 21 (functions 11&12, Find First & Find Next). As these are used by DIR command, if virus is in memory, DIR will infect all .COM or .EXE files opened. Stealth: handler for INT 21 (fct 11&12) contains code to fake file size, so that DIR does NOT not reveal the increase in file length. Due to interception of INT 24, critical errors are not reported. An infected file's date, time & attributes are preserved, and R/O files are infected. Self-Identification in files: virus checks bytes 3 & 4 in COM files, which are set to 52 43 ('RC'); in infected EXE file, CRC field in header is set to sum of initial CS and IP fields plus 1b3. System infection: when an infected file is run, virus decodes a block containing the recovery information, and then issues INT 1. If virus is already active this is intercepted, and interrupt handler restores the file and runs it. Otherwise the virus reduces the size of last memory block by 60h paras, and copies itself to offset 40h in block thus reserved. Self-Identification in memory: test INT 1 values. Infection Trigger...: Execution of an infected file, and after infec- tion of memory, any use of INT 21 function 4B00 (Find First/Find Last), e.g. issuing a DIR command. Storage media affected: Interrupts hooked...: INT 21 functions 11, 12, 4B00, & B5; INT 24. Damage..............: Permanent Damage: Upon trigger condition, virus attempts to format cylinder zero, head zero, on drive C. If this fails, virus then tries drives A, then B. If it succeeds in formatting any drive, it gives a message (see Transient Damage) and then resets the counter. Transient Damage: if virus succeeded in formatting any drive, it issues the message: "Your disk is formated by the LOREN virus. Written by Nguyen Huu Giap. Le Hong Phong School *** 8-3-1992" Then, the damage counter is set to zero. and then resets the infection counter. Damage Trigger......: Permanent Damage: virus counts number of files infected after last boot; upon counter=20, Permanent Damage function is triggered. Transient Damage: this is triggered upon success- ful completion of the Permanent Damage. Particularities.....: 1) As damage counter is reset when virus is loaded into memory, damage function (payload) will only be triggered if 20 files are infected in a single session. This may easily be achieved using multiple DIRs. 2) Message (see Transient Damage) is encrypted. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: CYBEC Pty, Hampton Victoria/Australia Classification by...: Roger Riordan (riordan.cybec@mhs.oz.au> Documentation by....: Roger Riordan Klaus Brunnstein (CVC entry) Date................: 31-July-1993 Information Source..: Analysis of Virus ===================== End of Loren Virus =============================== ====== Computer Virus Catalog 1.2: Mabuhay Virus (31-July-1993) ======== Entry...............: Mabuhay Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: Mid 1993 where.: Manila, Philippines Classification......: File Virus (COM,EXE Infector), Memory resident Length of Virus.....: 1.Length (Byte) on media: 2660 (+16) Bytes 2.Length (Byte) in RAM: 2688 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: DOS 2.0 or later Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- Type of infection...: File infection: Infexts COM and EXE files by appending itself to file. Self-Identification in files: Compares entry point code with its own code. System infection: Upon executing an infected file, virus makes itself resident in low memory. Self-Identification in memory: test for given value in INT 21 register. Infection Trigger...: Once resident, any file executed will be infected. Storage media affected: Interrupts hooked...: INT 21 Damage..............: Permanent Damage: Virus damages EXE/COM files of opposite type as it checks only file extension. Transient Damage: Plays music and displays color graphic an following text on screen: "June 12 - the Independence Day of the Philippines. ++ * ++ ++ \|/ ++ ----- * ++++++++++++++++++ /|\ ++ ++ * ++ ++ MABUHAY ANG PILIPINAS! Dedicated to Manong Eddie." The image in the middle (displayed in graphic, above approximated in ASCII) displays the Philippine flag and is blue on top, red below with a gray (gray background and yellow foreground) field inside horizontal V (">") on left side of the flag. Damage Trigger......: Permanent Damage: --- Transient Damage: June 12th, any year Particularities.....: 1) Message is encrypted in virus. 2) Virus was captured by integrity check on several machines in metro Manila. It is "in the wild" in Philippines and not detected by scanners existing in July 1993. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: No scanner detects this virus on publication Standard means......: Delete infected file and replace by clean one. --------------------- Acknowledgement ---------------------------------- Location............: Stiller Research, Tallahassee Florida Classification by...: Wolfgang Stiller Documentation by....: Wolfgang Stiller (CAROBase entry) Klaus Brunnstein (Virus Catalog entry) Date................: 15-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Mabuhay Virus ============================ ======== Computer Virus Catalog 1.2: NGUYEN Virus (31-July-1993) ======= Entry...............: NGUYEN Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: where.: Classification......: File Virus (EXE, COM infector), memory resident Length of Virus.....: 1.Length on storage media: 1740 Bytes (appended) 2.Length in memory: 3082 Bytes --------------------- Preconditions ----------------------------------- Operating System(s).: MSDOS Version/Release.....: Release 2.x and above Computer model(s)...: IBM compatibles --------------------- Attributes -------------------------------------- Easy Identification.: 1) Texts "Hacker: NGUYEN HIEU VINH" and "South of Viet Nam" can be found near end of an in- fected file ($200 bytes offset approx). 2) Infected files have date/time: 8.8.88, 8.08. 3) If virus is resident, chkdsk or mem will report 3082 bytes less total memory than expected. Scan String.........: String "cd 21 81 f9 04 41 75 09 81 fa 08 11" can be found near the end of an infected file. Type of infection...: EXE-files: standard ways of infecting EXE-files. COM-files: standard appending method. Infection Trigger...: Virus will become resident when an infected program is executed. After becoming resident, every file executed via INT 21, AH=4B (Load and Execute) will be infected. Storage media affected: Any files executed will be infected. Interrupts hooked...: INT 21, INT 24 (only during infection), INT 1C (see particularities). Damage..............: Permanent Damage: If file is created or opened to Read Only, depending on random choice, virus overwrites file from beginning with text "Hacker: NGUYEN HIEU VINH " where may be related to virus' author. Permanent/Transient Damage: Denial of service, message "ATV, VDW and LF to kill me!!!" dis- played and potentially INT 21 code trashed (see Particularities 2). Transient Damage: Overwriting 1st line of screen with text: "DBSoft-Do…n Th…n T£ l… 1 ke tr“m cap software. He's a professional thief...". Damage Trigger......: Permanent Damage: Creating or opening a file with Read-Only attribute will trigger the damage function when virus is resident. Permanent/Transient Damage: given number of infections AND detection of files starting with "AV", "VD" and "LF". Transient Damage: Given number of infections. Particularities.....: 1) The file date/time stamp is used as infection flag, with Date/Time=8.8.88, 8.08 indicating infection by this virus. 2) After a given number of total infections, if a file is executed whose name starts with "AT", "VD","LF" it's execution will be denied; this may be intended as attack on some AV soft- ware. Then a message will be written that you should not use "ATV, VDW and LF to kill me!!!". Virus also seems to trash INT 1B vector on this occasion (ctrl-break-check). 3) After a given numbers of total infection, virus will additionally hook INT 1C and after some time will display the text "DBSoft-Do…n Th…n T£ l… 1 ke tr“m cap software. He's a pro- fessional thief..." on screen's first line (writing directly to the screen, not caring about the actual videomode). 4) Infected files will be shown with their normal length in a directory if virus is resident. 5) Virus does not check length of COM files before infection, which may result in COM files with length > 64 kBytes which cannot be executed after infection. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: None Countermeasures successful: At publication time, no AV product detects or clean this virus successfully. Standard means......: Delete and replace infected files. --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University Hamburg, Germany Classification by...: Toralv Dirro Documentation by....: Toralv Dirro Date................: 31-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Nguyen Virus ============================== ========= Computer Virus Catalog 1.2: NoInt Virus (31-July-1993) ======= Entry...............: NoInt Virus Alias(es)...........: --- Virus Strain........: Stoned Virus Strain Virus detected when.: where.: Classification......: System virus (MBR,FBR infector), memory resident Length of Virus.....: 1.Length on media: 1 Sector 2.Length in memory: 1 KByte 3.Length of virus code: 363 Bytes. --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: 2.xx upward Computer model(s)...: IBM-PC, XT, AT and compatibles --------------------- Attributes --------------------------------------- Easy Identification.: 1) Memory size reduced: CHKDSK will report 2KBytes less memory than installed. 2) FBR/MBR contain following hex-string at offset 00CB, which may be used as scanstring: "33 DB 33 C9 33 D2 2E FF 2E D6 00 00 7C 00 00" (part of virus' stealth function). Type of infection...: File infection: --- System infection: Upon booting from an infected diskette, virus will make itself memory re- sident and infect disk's Master Bootrecord. Subsequently, any access to any non-infected diskette will result in it's infection. Upon infection, a disk's MBR is saved at Head 0, Cylinder 0, Sector 7; a diskette's original FBR is saved at Head 1,Cylinder 0,Sector 3. Infection Trigger...: Booting from an infected diskette; when virus is memory resident: accessing any diskette. Storage media affected: Hard disk, diskette Interrupts hooked...: INT 13h Damage..............: Transient damage: --- Permanent damage: On diskette, virus will store original Bootsector in part of root-directory; entries previously referenced there are lost. Damage Trigger......: Transient damage: --- Permanent damage: accessing a diskette. Particularities.....: --- Similarities........: Variant of Stoned Virus --------------------- Agents ------------------------------------------- Countermeasures.....: According to their documentation, many antivirus products claim to recognize/eradicate virus. Countermeasures successful: Standard means......: 1) Reboot from clean bootdisk. 2) Use SYS-Command to reinstall BOOTsector on floppies. 3) Use FDISK /MBR to reinstall Master Boot sector on hard disk (MS-DOS 5.00 or higher only). --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center Hamburg, Univ Hamburg, Germany Classification by...: Ulf Heinemann Documentation by....: Ulf Heinemann Date................: 31-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Noint Virus =============================== ===== Computer Virus Catalog 1.2: Parity_Boot Virus (31-July-1993) ===== Entry...............: Parity_Boot (A) Virus Alias(es)...........: P-Check Virus (see: CVC entry July 1992) Virus Strain........: Parity_Boot Virus Strain Virus detected when.: April 1992 where.: Classification......: System (bootsector/partition table (MBR)) virus, stealth Length of Virus.....: Length on medium: 512 Bytes (=1 sector) --------------------- Preconditions ----------------------------------- Operating System(s).: MS-DOS Version/Release.....: Computer model(s)...: IBM PC and compatibles --------------------- Attributes -------------------------------------- Easy Identification.: Memory decreased by 1 kBytes after infection; no plain text in bootsector or MBR, like "Non system disk..." or "Bad partition....". Type of infection...: Boot sectors and partition table of media. Infection Trigger...: Booting from an infected disk will infect the hard disk; from this time, all read accesses to the boot sector of any physical drive will infect the medium in this drive. Storage media affected: All media: Floppy disk, hard disk. Interrupts hooked...: INT 09, INT 13. Damage..............: Transient/Permanent damage: Some built-in mechanism simulates a parity error message on the screen after 1 hour of opera- tion plus an additional hour for each infec- tion: the more infections, the longer till the parity check display. The parity error simulation switches to 40 x 25 mode, displays 'PARITY CHECK' and then halts the processor. Virus constantly garbles the INT01&INT03 entries, so that debug will not work; this is not tied to a trigger. Damage Trigger......: The internal timer tick (not the CMOS clock) is used for timing. Trigger= 1+n hours after boot up (n=number of infections since booting). Particularities.....: 1) Message text "PARITY CHECK" is constantly encrypted with key 55h. 2) In summer 1993, virus (variant B) is "in the wild" in Germany. Similarities........: Parity_Boot Virus Strain: variants B,C --------------------- Agents ------------------------------------------ Countermeasures.....: Up-to-date antiviral products, e.g. McAfee Scan, Skulason F-PROT, Dr.Solomon FindViru. Remark: invoking Scan or F-PROT after another scanner having detected and deleted this virus may result in a "false positive" diagnosis as both scanners scan also DOS buffers (where virus would NOT reside) which may not be cleared by the AV product used before. Removal: SYS on floppies; FDISK /MBR (DOS 5.0) Standard means......: --------------------- Acknowledgement -------------------------------- Location............: Micro-BIT Virus Center, Univ Karlsruhe, Germany Classification by...: Christoph Fischer (Klaus Brunnstein, VTC) Documentation by....: Christoph Fischer Klaus Brunnstein (VTC, update) Date................: April-1992 (original entry: P-Check) 31-July-1993 (update) Information Source..: reverse analysis of virus code ===================== End of Parity_Boot Virus ======================== ======== Computer Virus Catalog 1.2: Peter Virus (31-July-1993) ======== Entry...............: Peter Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: May 1993 where.: Japan Classification......: System virus (MBR,FBR infector) Length of Virus.....: 1.Length (Byte) on media: 5 sectors 2.Length (Byte) in RAM: 4 kBytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles: models > 80286, CMOS --------------------- Attributes --------------------------------------- Easy Identification.: Type of infection...: File infection: --- Self-Identification in files: --- System infection: When booting from an infected disk or diskette, virus installs itself in hi-memory. On media, virus code is 5 sectors long, stored at at 0/0/2 (disk), an at 50/0/2 (floppy, only if sectors/track is at least 15) Self-Identification on disks: MBR [0x1FD] == 0xBB, FBR [0x1FD] == 0x11 Self-Identification in memory: --- Infection Trigger...: MBR: (Boot) & (MBR[0x1FD]!=0xBB) FBR: (INT13) & (AX==02 | AX==03) & (FBR[0x1FD]!=11) & (FBR[0x18]>=0x0F) That is, when booting from an infected floppy, virus infects hard disk unless its mark is already there, and when using a floppy in A: it gets infected unless the mark is there, or it has less than 15 sectors/track. Storage media affected: Hard disk, floppy disks Interrupts hooked...: INT 13/02, 13/03 Damage..............: Permanent Damage: If user answers any of the questions (see Transient Damage) incorrectly, virus returns without restoring the garbled part of hard disk. If user answers correctly, virus restores garbled part of hard disk and boots normally. (Not actually tested) Transient Damage: Upon trigger conditions (see Transient Damage Trigger), virus displays a message (see below), garbles part of hard disk by XORing with hex 78, and asks four questions about pop music. Message, questions and replies (excrypted): "Good morning,EVERYbody,I am PETER II Do not turn off the power, or you will lost all of the data in Hardisk!!! WAIT for 1 MINUTES,please... Ok.If you give the right answer to the following questions,I will save your HD: A. Who has sung the song called "I`ll be there" ? 1.Mariah Carey 2.The Escape Club 3.The Jackson five 4.All (1-4): B. What is Phil Collins ? 1.A singer 2.A drummer 3.A producer 4.Above all (1-4): C. Who has the MOST TOP 10 singles in 1980`s ? 1.Michael Jackson 2.Phil Collins (featuring Genesis) 3.Madonna 4.Whitney Houston (1-4): CONGRATULATIONS !!! YOU successfully pass the quiz! AND NOW RECOVERING YOUR HARDISK ...... Sorry!Go to Hell.Clousy man!" Damage Trigger......: Permanent Damage: If user answers a question in the quiz wrong. Transient Damage: If CMOS clock bytes 7 and 8 contain 27 and 2. Particularities.....: 1) Correct answers are: 4,4,2 (at least in the virus author's opinion) 2) Coding style (and English) is very odd and self-taught-looking; e.g. Virus author seems not to know about direct addressing modes. 3) Limitations: Virus executes only if CPU >= 286 (uvirus ses PUSHA and POPA), CMOS (for date for payload) Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: IBM High Integrity Computing Lab, Hawthorne N.Y. Classification by...: David Chess, HICL Documentation by....: David Chess (CAROBase entry) Klaus Brunnstein, VTC Hamburg (Virus Catalog) Date................: 24-May-1993, 1993 Information Source..: Reverse analysis of virus code ===================== End of Peter Virus =============================== = Computer Virus Catalog 1.2: PS-MPC2 Virus Generator (31-July-1993) === Entry...............: PS-MPC2 Virus Generator Alias(es)...........: PS-MPC G2 = Phalcon-Skism G2 0.70 beta Virus Generator Virus Strain........: Phalcon-Skism G2 generated Viruses (generates com- pact easily modifiable commented source code) Virus detected when.: where.: Classification......: Virus-Generator: Creates Assembly Code for Resident and Non-resident File Infectors, optionally Self-encrypting. Length of Virus.....: Depends on creation options and action routine --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS Version/Release.....: Versions 4.0 and upward Computer model(s)...: IBM & compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Variable self-identification Type of infection...: COM and EXE infector, appending Infection trigger...: 1) Execution of an infected program. 2) Every INT 21 call in resident viruses. Storage media affected: EXE and or COM files infected; COMMAND.COM may be infected (parameter) Interrupts hooked...: INT 21 all functions, (INT 24) Damage..............: To be written by specific virus author and to be linked to PS-MPC G2 generated code. Damage Trigger......: Depending on specific virus. Particularities.....: - PS-MPC G2 Viruses decrease memory in high memory-area if resident. - The PS-MPC G2 generator offers the following major Skeleton configuration options: * Infection C(OM)/E(XE) (may be both) * CommandCom (Yes/No): infect COMMAND.COM * Resident (Yes/No) * Encrypted (Yes/No), Encryption: xor, add * IDWord (2 character:self-identification) * MinSize/MaxSize: minimum/maximum size of COM files to be infected * Infections#: max.number of infections * ErrorHandler: critical error handler for Abort,Retry,Fail messages * VirusName, AuthorName: strings * AntiDebugger (Yes/No): If this option is set to Yes, the CPU-generated Breakpoint Interrupt INT3 points to INT21 and is also used from the virus itself instead of INT21. Similarities........: 1) PS-MPC (original version) 2) Following PS MPC G2 generated viruses are known: --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: FindViru, F-Prot (etc) detect PS MPC G2 generated viruses. Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: University of Hamburg, Virus Test Center, Germany Classification by...: Holger Prescher & Frank Bohnsack Documentation by....: Holger Prescher & Frank Bohnsack Date................: 31-July-1993 Information Source..: Reverse-Analysis of Generator, Skeleton files. ===================== End of PS-MPC2 Virus Generator =================== ======== Computer Virus Catalog 1.2: Qrry Virus (31-July-1993) ========= Entry...............: Qrry Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: March 1993 where.: USA Classification......: System virus (MBR, FBR infector), memory resident Length of Virus.....: 1.Length (Byte) on media: 1 Sector 2.Length (Byte) in RAM: 1 kByte --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Test if bootrec[0]==EBh & bootrec[0170h]==ABCDh Type of infection...: File infection: --- Self-Identification in files: --- System infection: Virus code stored at 27h/01h/09h. Upon booting from an infected disk, virus makes itself memory resident (in hi-memory). Self-Identification in memory: --- Self-Identification on disk: bootrec[0]==EBh & bootrec[0170h]==ABCDh Infection Trigger...: If given values in INT 13 registers are found. Storage media affected: Hard disk, floppy disks Interrupts hooked...: INT 13/0201 Damage..............: Permanent Damage: overwrites the first 9 sectors of the first 3 tracks on any disk or diskette head that's read from. Transient Damage: --- Damage Trigger......: Permanent Damage: All days in December: Real_Time_Clock_Month == 12 Transient Damage: --- Particularities.....: Name "QRRY" is taken from some ASCII characters that happens to appear in virus code; no other obvious characteristic for naming. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: IBM High Integrity Computing Lab, Hawthorne N.Y. Classification by...: David Chess, HICL Documentation by....: David Chess (CAROBase entry) Klaus Brunnstein, VTC Hamburg (Virus Catalog) Date................: March 8, 1993 Information Source..: Reverse analysis of virus code ===================== End of Qrry Virus ================================ ======= Computer Virus Catalog 1.2: Requires Virus (31-July-1993) ====== Entry...............: Requires Virus Alias(es)...........: Requires.981 = Demise = Later Virus Virus Strain........: --- Virus detected when.: Russia where.: --- Classification......: Resident, appending-EXE and prepending-COM file infector Length of Virus.....: In files: 981 bytes (EXE files are first padded to a multiple of 16 bytes). In memory: 1952 bytes after the last MCB. --------------------- Preconditions ------------------------------------ Operating System(s).: MS/PC DOS Version/Release.....: 3.0+ Computer model(s)...: Any MS-DOS compatible computer --------------------- Attributes --------------------------------------- Easy Identification.: All infected files contain the message "This program requires MS-DOS 3.00 or later$". Self Identification.: In memory: INT 21h/AH=0B3h returns 9051h in AX. In COM files: if the first two bytes of the file are 50h 8Ch, it is considered as infected. However, the first two bytes of the virus are actually 50h 0B4h, which causes COM files to be re-infected multiple times. In EXE files: if the two bytes at offset 10h in EXE header are 5Ch 09h (in the SP field), then file is considered as infected. Type of infection...: Files with extension 'COM' and 'EXE'. The true file type is determined by checking the first two bytes for 'MZ', however. No check is made for 'ZM'. Files ??????D.COM is not infected. Infection Trigger...: OpenFileHandle and LoadAndExec (INT 21h/AH=3Dh and INT 21h/AX=4B00h). Storage media affected: Any MS-DOS file system which contains infectable objects. Interrupts hooked...: INT 21h and INT 24h (only during infection). Damage..............: Transitive damage: infected programs executed under a version of DOS below 3.0 display message "This program requires MS-DOS 3.00 or later" and refuse to run. Permanent damage: --- Damage Trigger......: Transitive damage: Execution of an infected file under a version of DOS below 3.0. Permanent damage: --- Particularities.....: 1) When an infected file is executed,virus removes itself from there, in an attempt to hide the source of infection and to prevent from being detected by self-checking programs. 2) COM files can be infected multiple times. 3) Due to some bugs, multiply infected files can not always be restored to their original state but will still contain parts of the virus. Those parts, however, will be inactive and will never receive control. However, they may cause "ghost positive" alerts by some scanners (since a significant part of the virus potentially containing scan strings used by scanners, remain in such incompletely "cleaned" files). Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Virus uses no full stealth, tunneling, or poly- morphism, so most integrity checkers, monitors, and up-to-date scanners should have no problems detecting it. Countermeasures successful: F-Prot 2.04a was tested and was able to successfully remove virus when removable. Standard means......: If you can remove it without any anti-virus progs --------------------- Acknowledgement ---------------------------------- Location............: Virus Test Center, University of Hamburg, Germany Classification by...: Vesselin Bontchev Documentation by....: Vesselin Bontchev Date................: 27-Jul-1992 Information Source..: Reverse analysis of virus code ===================== End of Requires Virus ============================ ======== Computer Virus Catalog 1.2: RMBD Virus (31-July-1993) ========= Entry...............: RMBD Virus Alias(es)...........: --- Virus Strain........: Virus detected when.: July 1993 where.: USA Classification......: System virus (MBR,FBR infector), memory resident Length of Virus.....: 1.Length (Byte) on media: 1 (or 0) sector 2.Length (Byte) in RAM: 1 kByte --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Text in virus: "RMBDRMCC B WRM" Type of infection...: File infection: --- Self-Identification in files: --- System infection: Upon booting from infected media, virus makes itself memory resident (hi-memory). By manipulating INT 13, virus hides it's pre- sence in memory (stealth mechanism). Self-Identification in memory: none Self-identification on disks: none Infection Trigger...: MBR of drive 80 is infected on every boot from an infected diskette or hard disk. Diskette boot records are infected on any INT13 read or write. Storage media affected: Hard disk, floppy disks Interrupts hooked...: INT 13/02, 13/03 Damage..............: Permanent Damage: 1) Overwrites 0x0E sectors, starting at sector 4, of some tracks on cylinder 0. 2) Side effects: Infected diskettes will not have a valid BPB, and will often not be readable at all. When a machine is booted from an infected diskette, the virus will infect the hard disk, and then boot from the bootable partition on the hard disk! (Rather than booting from diskette.) Transient Damage: --- Damage Trigger......: Permanent Damage: 1) If INT13 AND (AH=02 or AH=03) AND (0040:0071 & 0x80 set) [The BIOS "break" bit, high bit of 0040:0071, is set during an INT13 read or write] 2) --- Transient Damage: --- Particularities.....: 1) Hard disk required, even to boot from an infected floppy. 2) Very unusual infection methods, in that it saves neither original MBR of hard disks nor original DBR of diskettes. Instead, it contains essentially all of the code from the normal MBR, and uses that to boot the system. Even when booting from an infected floppy, virus reads MBR of hard disk, copies partition table, and (after infecting of hard disk) uses MBR code to boot from hard disk. 3) Meaning of text "RMBDRMCC B WRM" unclear. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: --------------------- Acknowledgement ---------------------------------- Location............: IBM High Integrity Computing Lab, Hawthorne N.Y. Classification by...: David Chess, HICL Documentation by....: David Chess (CAROBase entry) Klaus Brunnstein, VTC Hamburg (Virus Catalog) Date................: 6-July-1993 Information Source..: Reverse analysis of virus code ===================== End of RMBD Virus =============================== ======= Computer Virus Catalog 1.2: Runtime Virus (31-July-1993) ======= Entry...............: Runtime Virus Alias(es)...........: Runtime-err412 Virus Virus Strain........: --- Virus detected when.: July 1993 where.: USA Classification......: File virus (COM, COMMAND.COM infector) Length of Virus.....: 1.Length (Byte) on media: 365 Bytes 2.Length (Byte) in RAM: 0 (not memory resident) --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: MSDOS >= 3.0 Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Text in virus code: "Runtime error 412" Type of infection...: File infection: virus infects COM files, including COMMAND.COM. To hide itself against detection (stealth), it restores original time and date stamps to files after infection. Self-Identification in files: code intends to check for initial NEAR CALL (0eh), doesnot work. System infection: not memory resident. Self-Identification in memory: --- Infection Trigger...: Upon execution of an infected file Storage media affected: Disk and diskette Interrupts hooked...: None Damage..............: Permanent Damage: no intended permanent damage. Side effect: Uncontrolled file growth due to multiple infections. Transient Damage: 1) Hangs system occasionally on trigger conditions. 2) Displays message "Runtime error 412" followed by possible garbage. Damage Trigger......: Permanent Damage: --- Transient Damage: 1) On Fridays before 11:00 AM if clock @ 40:06Ch >0b0h. 2) Execution of infected file. Particularities.....: Virus cannot infect read-only files. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: At publication date, virus was not detected by tested scanners (VIRx,McAfee's Scan,F-Prot, IBM anti-virus, and TBscan602). Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: Stiller Research, Tallahassee Florida Classification by...: Wolfgang Stiller Documentation by....: Wolfgang Stiller (CAROBase entry) Klaus Brunnstein (Virus Catalog entry) Date................: 6-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Runtime Virus ============================= ========= Computer Virus Catalog 1.2: Su Virus (31-July-1993) ========== Entry...............: Su Virus Alias(es)...........: Susan Virus Virus Strain........: --- Virus detected when.: April 1993 where.: USA Classification......: Overwriting File (EXE) Virus, memory resident Length of Virus.....: 1.Length (Byte) on media: 864 Bytes 2.Length (Byte) in RAM: 571 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: MSDOS>=3.30 (Bug: Checks for DOS 3.03) Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Virus contains the following texts, unencrypted: "Bad command or file name", "Susan", "*.*", "*.EXE", "DIR" Type of infection...: File infection: Virus infects EXE files by over- writing it's code over the first 864 bytes. Self-Identification in files: FileTime.Seconds=1Fh System infection: Upon executing an infected EXE file, virus makes itself memory resident (in low memory) Self-Identification in files: if given value in INT 2Fh register found. Infection Trigger...: If (a single "DIR" issued) AND (FindFirst finds an uninfected .EXE file) Storage media affected: Interrupts hooked...: INT 2F/10F, 2F/AE00, 2F/AE01 Damage..............: Permanent Damage: 1) Infected files are overwritten and destroyed. 2) Deletion of all files in current directory. Transient Damage: Instead of executing the infected program, virus displays the message: "Bad command or file name" and then terminates. Damage Trigger......: Permanent Damage: 1) Upon infection (see Infection Trigger) 2) 16 Infections since activation Transient Damage: Staring an infected program. Particularities.....: 1) Virus does not hand control over to infected program; instead, it terminates with afore- mentioned message. 2) Virus uses INT 21;AX=5D00h to delete files. 3) Hooked interrupts (AH=0AEh) are reportedly called by COMMAND.COM just before executing commands from keyboard. 4) Naming: "Susan" found in text; "Su" used as register content. Similarities........: --- --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: Classification by...: Snorre Fagerland Documentation by....: Snorre Fagerland (CAROBase entry) Klaus Brunnstein (VTC, Virus Catalog entry) Date................: 25-June-1993 Information Source..: Reverse analysis of virus code ===================== End of Su Virus ================================== ======= Computer Virus Catalog 1.2: Terminator II (31-July-1993) ======= Entry...............: Terminator II Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: where.: Classification......: File virus (COM,EXE infector); memory resident; stealth. Length of Virus.....: 1.Length (Byte) on media: 2294 Bytes 2.Length (Byte) in RAM: 2448 Bytes. --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles. --------------------- Attributes --------------------------------------- Easy Identification.: 1) Last two bytes of infected are equal to 1000h, seconds value of FileTime set to 56 (see: Self- Identification in files). 2) File allocation errors shown by CHKDSK. Amount of free memory is decreased by 2448 bytes. Type of infection...: File infection: virus appends itself to end of an EXE or COM file and changes the CS:IP in EXE header or places JMP to virus code in COM files. Only files larger than 1388 bytes will be in- fected. File with names containing "SCAN" in any place of name will not be infected. Self-Identification in files: Last two bytes of virus are equal to 1000h, seconds value of FileTime set to 56. System infection: When starting an infected file, virus makes itself memory resident at top of system memory but below 640K boundary (usually at 9f67:0000). Virus allocates memory by de- creasing size of the last "Z" Memory Control Block by 2448 bytes. Self-Identification in memory: function 4BFEh of DOS services reconstruct and execute program if virus is in memory, otherwise virus conti- nues execution and installs itself in memory. Infection Trigger...: Executing an infected file, or Opening, Loading and Executing any file when memory is infected. Storage media affected: Interrupts hooked...: INT 21h(Dos-Services): functions: 0Fh (Open_FCB), 11h (Find1st_FCB),12h (FindNxt_FCB),3dh (Open), 3eh (Close),3fh (Read),42h (Seek),4eh (Find1st), 4fh (FindNxt),4B00h (Load/Execute),4B01h (Load), 6ch (Extended_Open). Damage..............: Permanent Damage: 1) Virus slows down speed of computer, mixing output to printer: case of every 16th character will be reversed and 0 will be changed to 9. 2) Displays string "TERMINATOR", overwrites CMOS, overwrites 1 side of all hard drives. Transient Damage: --- Damage Trigger......: Permanent Damage: 1) Damage 1) will be triggered two month after infection, if second bit of date is non-zero. 2) Damage 2) will be triggered if date is bigger than date of infection plus two month plus ten days. Transient Damage: --- Particularities.....: Due to his setalth technique, virus is almost in- visible when active in memory. It has prevention from "curing" by packing infected files, mostly stealth viruses can be disinfected by such a trick, because usually stealth virus returns clean file to system, and file becomes clean during packing. Similarities........: NOT related to Terminator as described in VSUM! --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Detection: Gobbler-II v3.0 Disinfection: Gobbler-II v3.0+ Standard means......: Delete infected files and replace with clean ones. --------------------- Acknowledgement ---------------------------------- Location............: Classification by...: Received from unnamed contributor outside VTC Documentation by....: Klaus Brunnstein (VTC, CVC entry) Date................: 31-July-1993 Information Source..: ===================== End of Terminator II Virus ======================= ======== Computer Virus Catalog 1.2: Tonya Virus (31-July-1993) ======== Entry...............: Tonya Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: Summer 1993 where.: Melbourne, Australia Classification......: File virus (COM infector), memory resident, variably encrypted Length of Virus.....: 1.Length (Byte) on media: 971 Bytes 2.Length (Byte) in RAM: 2016 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MSDOS Version/Release.....: Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: Virus is variably encrypted, no signature possible (after decryption, text may be identified) Type of infection...: File infection: COM files are infected upon opening (INT 21/3D) or loading for execution (INT 21/4B), if not too short (<50) or too long (>64,303). Upon detecting an yet uninfected COM file with proper size, virus appends it's code at the end and restores date, time and attributes previously saved. Length of COM files increase by 971 bytes. Self-Identification in files: Stealth: Virus is variably encrypted. Virus inter- cepts DOS functions OpenFile and Load&Execute, and it saves date&time attributes, to avoid detection. System infection: When an infected COM file is executed, virus after decryption first tries to make itself memory resident, using a non- standard DOS function; if not yet resident, virus loads itself to top-of-memory, reducing available memory by 2016 bytes. Self-Identification in memory: checking register value of an undocumented DOS function. Infection Trigger...: Executing an infected file, or (when virus is memory resident) invoking DOS functions Open File or Load&Execute, as long as 50 Documentation by....: Roger Riordan Klaus Brunnstein (CVC entry) Date................: 31-July-1993 Information Source..: Analysis of Virus ===================== End of Tonya Virus =============================== ==== Computer Virus Catalog 1.2: Trivial Virus Strain (31-July-1993) === Strain................ Trivial Virus Strain Classification........ All Trivial Viruses: Overwriting COM infectors, direct action; not memory-resident. Size of Viruses....... On media: various (see specific entries) ======================================== Virus Entry#1......... Trivial.Psycho = Trivial.Hastings Virus Detected: when........ --- where....... --- Size of virus......... Length: 200 bytes (overwriting) ------------------------------- Virus Entry#2......... Trivial.Hanger Virus Detected: when........ --- where....... --- Size of virus......... Length: 143 bytes (overwriting) ------------------------------- Virus Entry#3......... Trivial.Banana Virus Detected: when........ --- where....... --- Size of virus......... Length: 139 bytes (overwriting) ------------------------------- Virus Entry#5......... Trivial.50 Virus Detected: when........ --- where....... --- Size of virus......... Length: 50 bytes (overwriting) ------------------------------ Virus Entry#6......... Trivial.46 = DeathCow Virus Detected: when........ --- where....... --- Size of virus......... Length: 46 bytes (overwriting) Variant............... Trivial.42 Size of virus......... Length: 42 bytes (overwriting) ------------------------------ Virus Entry#7......... Trivial.45.A = Shortest Virus Detected: when........ --- where....... --- Clones................ Trivial.45.B virus, Trivial.45.C virus Size of virus......... Length: 45 bytes (overwriting) Variant............... Trivial.35 Virus Size of virus......... Length: 35 bytes (overwriting) ------------------------------ Virus Entry#8......... Trivial.44 Virus Detected: when........ --- where....... --- Length of virus....... Length: 44 bytes (overwriting) ------------------------------ Virus Entry#9......... Trivial.39 Virus Detected: when........ --- where....... --- Length of virus....... Length: 39 bytes (overwriting) Variant............... Trivial.38 Virus Length of virus....... Length: 38 bytes (overwriting) ------------------------------ Virus Entry#10........ Trivial.31.A Virus Detected: when........ --- where....... --- Clone................. Trivial.31.B = Miniscule Virus Size of virus/clone... Length: 31 bytes (overwriting) ------------------------------ Virus Entry#11........ Trivial.30.A Virus Detected: when........ --- where....... --- Clones................ Trivial.30.B, Trivial.30.C Virus Size of virus/clones.. Length: 30 bytes (overwriting) ------------------------------ Virus Entry#12........ Trivial.25 Virus Detected: when........ --- where....... --- Length of virus....... Length: 25 bytes (overwriting) Variant............... Trivial.26 Virus Length of virus....... Length: 26 bytes (overwriting) ---------------------- Preconditions --------------------------------- Operating System(s)... MS/PC-DOS 3.x upwards Computer models....... All IBM PC/AT compatibles ---------------------- Common Attributes of Strain Viruses ----------- Easy identification... Infected files will not run as they are over- written by the resp. virus; only virus code will be executed, and system will then crash. Type of infection..... Self-identification: none (just overwriting) COM files: not increased, unless infected file is shorter than virus. Files can only be infected when an infected host is started; first bytes of infected file (length depending on virus/variant) will be overwritten by virus. EXE files: no infection, unless virus infects with the *.* pattern. Infection trigger..... Any time an infected file is run, the viruses infects one or all .COM files in the current directory (see entries for details). Affected media........ Files on HardDisk or any FloppyDisk. Interrupts hooked..... --- Damage................ Permanent damage: infected file is overwritten. Damage trigger........ Execution of an infected file. Particularities....... The file date/time will be set to the date of the infection. Similarities.......... In stepwise reduction of size, Trivial viruses aim at achieving the shortest code suitable for infection. Though probably different authors worked on the viruses, this common goal is explicitly mentioned in some texts. While early version contain several texts, later versions contain essentially code suf- ficient to infect files by overwriting them; but texts may be deposited in infected files at remote locations. Every virus in Trivial strain infects one or all *.COM or *.C* or *.* files in the current directory, by overwriting the first bytes of the files with itself. If the file to be infected is smaller than the resp. virus, the file size will grow to the virus' size. The wildcard pattern *.* includes the files .COM .EXE .OVL .SYS .DOC .TXT etc. ---------------------- Special Attributes of Trivial.Hastings ---------- Virus name............ Trivial.Psycho or Trivial.Hastings Size.................. 200 bytes Type of infection..... Infects the 1st .COM file in current directory by overwriting it. Easy identification... Texts found in virus at offset 40dez '*.COM by' (encrypted name deleted) 'AKA Nick Haflinger...' 'Zopy me I want' to travel' 'I can now program in assembler' 'This program was written in the town' 'of Hastings hehehehe!' ---------------------- Special Attributes of Trivial.Hanger ------------ Virus name............ Trivial.Hanger Virus Size.................. 143 bytes Type of infection..... Infects all *.C* files (*.COM, but also *.C) in current directory by overwriting them. Easy detection........ Infected files contain (unencrypted) message (see Transient damage) at offset 59dez. Damage................ Permanent damage: Overwriting infected files. Transient damage: After infection, virus displays the message: 'System Hanger! Enjoy! ' 'Note: Your system is now hanged.' 'Press Reset to continue.' Then systems may hang (HLT instruction) ---------------------- Special Attributes of Trivial.Banana ------------ Virus name............ Trivial.Banana Virus Size.................. 139 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. Easy identification... The following text is found in infected files at offset 80dez: 'BANANA, coded by Morbid Angel' '-92 in Stockholm/Sweden*.COM' Particularities....... Upon infection, file-attribute, time and date are saved and correctly restored. ---------------------- Special Attributes of Trivial.50 --------------- Virus name............ Trivial.50 Virus Size.................. 50 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. ---------------------- Special Attributes of Trivial.46 ---------------- Virus name............ Trivial.46 = DeathCow Virus Size.................. 46 bytes Type of infection..... Infects all *.COM files by overwriting the,. Variants.............. Optimized version is Trivial.42, Size.................. 42 bytes ---------------------- Special Attributes of Trivial.45 ---------------- Virus name............ Trivial.45.A = Shortest Virus Size.................. 45 bytes Type of infection..... Infects all *.COM files by overwriting them. Clones................ Trivial.45.B and Trivial.45.C (same size) Variants.............. Trivial.35 Virus Size.................. 35 bytes ---------------------- Special Attributes of Trivial.44 ---------------- Virus name............ Trivial.44 Virus Size.................. 44 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them ---------------------- Special Attributes of Trivial.39 ---------------- Virus name............ Trivial.39 Virus Size.................. 39 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. Variants.............. Trivial.38 Virus Size.................. 38 bytes Remark................ A slightly optimized version of Trivial.39 Virus ---------------------- Special Attributes of Trivial.35 ---------------- Virus name............ Trivial.35 Virus Size.................. 35 bytes Type of infection..... Infects one file with pattern *.C* by overwriting Remark................ A significantly optimized version of Trivial.45 ---------------------- Special Attributes of Trivial.31.A -------------- Virus name............ Trivial.31.A Virus Size.................. 31 bytes Type of infection..... Infects one file with pattern *.C* by overwriting ---------------------- Special Attributes of Trivial.31.B -------------- Virus name............ Trivial.31.B = Miniscule Virus Size.................. 31 bytes Type of infection..... Infects one file with pattern *.* by overwriting Easy identification... The following text is found in infected files ---------------------- Special Attributes of Trivial.30.A/B/C ---------- Virus name............ Trivial.30.A Virus Size.................. 30 bytes Type of infection..... Infects one file with pattern *.* by overwriting Variant#1............. Trivial.30.B Particularities....... Trivial.30.B overwrites 256 bytes of a file Remark................ Uses two different opcodes for same purpose Variant#2............. Trivial.30.C Virus Remark................ Some opcodes swapped, but 98% same code Particularities....... Trivial.30.C overwrites 30 bytes of a file ---------------------- Special Attributes of Trivial.25 --------------- Virus name............ Trivial.25 Virus Size.................. 25 bytes (or longer); infected file size will vary, due to some optimization in virus code, in the range of overwritten bytes 25 <= size <= 33049. Type of infection..... Infects one .COM file by overwriting Particularities....... Virus only works under specific conditions. Variants.............. Trivial.26 Virus Size.................. 26 bytes Type of infection..... Infects one *.* file Particularities....... As Trivial.25, this virus also works only under specific conditions ---------------------- Agents ----------------------------------------- Countermeasures....... Standard Means........ 1) Notice file length and file date/time. 2) Use ReadOnly attribute. 3) Infected files can only be disinfected by replacing them with the original files. ---------------------- Acknowledgements -------------------------------- Location.............. Virus Test Center, University Hamburg, Germany Classification by..... Stefan Tode Documentation by...... Stefan Tode Date.................. 31-July-1993 (Update of Feb-93 entry) Information source.... --- ====================== End of Trivial Virus Strain ===================== ======= Computer Virus Catalog 1.2: Warlock Virus (31-July-1993) ======= Entry...............: Warlock Virus Alias(es)...........: --- Virus Strain........: --- Virus detected when.: April 1993 where.: Kazakhstan Classification......: File Virus (COM,EXE,OVL;DBF infector), memory resident, partly (messages) encrypted Length of Virus.....: 1.Length (Byte) on media: 1a. EXE files: 1817 (+16) Bytes 1b. COM files: 1817 (+16)+4 Bytes 2.Length (Byte) in RAM: 3648 Bytes --------------------- Preconditions ------------------------------------ Operating System(s).: MS-DOS/PC-DOS Version/Release.....: MS-DOS/PC-DOS >= 2.0 Computer model(s)...: IBM PCs and Compatibles --------------------- Attributes --------------------------------------- Easy Identification.: --- (File[EOF-4] == 0B0Dh (0Dh, 0Bh)) Type of infection...: File infection: infects COM and EXE files by appending it's code (adapting to 16 bytes adress boundary); for COM files, virus adds extra 4 bytes after appending itself. Damages OVL and DBF files (though not infecting them). Self-Identification in file: checks bytes before EOF: File[EOF-4] == 0B0Dh (0Dh, 0Bh) System infection: upon starting an infected file, virus makes itself memory resident in memory (using TWIXT method). Self-Identification in memory: tests INT 21 register for given value. Additional check is made by a resident virus: it compares a piece of it's code to that of the caller (with bug). Infection Trigger...: Infection occurs if the following condition holds: Exec OR (Open OR Rename OR ChMod) AND FileExt IN [.EXE, .COM, .OVL, .DBF]) AND (FileName != "COMMAND.COM") AND (LengthCOM > 1024) AND (LengthCOM < 62687) AND (LengthEXE <= EXE_Image_Size (i.e.EXE file is not segmented)) AND (EXE_IP != 0eh (all LZEXE-packed files, in par- ticular AIDSTEST scanner)) AND (EXE_stack < EXE_Image_Size OR EXE_stack > EXE_Image_Size+72h (a bug - should be 720h) Storage media affected: Interrupts hooked...: INT 21/4B, 21/3D, 21/43, 21/56, 21/D000, 24, 2A Damage..............: Permanent Damage: 1) First 32 bytes of DBF files are overwritten with 0C3H value. 2) Side Effects: Overlays are damaged, some EXE files won't operate properly - virus body might be overwritten by program's stack. Transient Damage: --- Damage Trigger......: Permanent Damage: 1) File[0]==03 (usually .DBF files signature) and executing or opening or renaming or Get/Set File Attribute of infected file. 2) Executing such OVL or EXE files. Transient Damage: --- Particularities.....: 1) Virus contains following emcrypted strings (not displayed): "Revenge of WARLOCK!", "STACK STACK STACK STAC", "COMMAND.COM", "EXE", "OVL", "DBF". 2) For some MS-DOS versions (prev. to 4.0), virus patches direct DOS entry. Otherwise, it simply intercepts INT 21 vector. Similarities........: Tunnelling is borrowed from Yankee_Doodle.TP. --------------------- Agents ------------------------------------------- Countermeasures.....: Countermeasures successful: Standard means......: Delete infected files, replace wth clean ones. --------------------- Acknowledgement ---------------------------------- Location............: Program Systems Institute, Russian Academy of Sciences, Pereslavl-Zalessky, Russia Classification by...: Dmitry O. Gryaznov Documentation by....: Dmitry O. Gryaznov Klaus Brunnstein (VTC, Virus Catalog entry) Date................: 17-July-1993 Information Source..: Reverse analysis of virus code ===================== End of Warlock Virus =============================