125 lines
6.5 KiB
Plaintext
125 lines
6.5 KiB
Plaintext
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
|
³ VIRUS REPORT ³
|
|
³ Dark Avenger ³
|
|
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
|
|
|
Synonyms: Black Avenger
|
|
|
|
Date of Origin: September, 1989.
|
|
|
|
Place of Origin: Sofia, Bulgaria. First isolated at U.C. Davis.
|
|
|
|
Host Machine: PC compatibles.
|
|
|
|
Host Files: Remains resident. Infects COMMAND.COM, EXE, COM, overlay
|
|
files.
|
|
|
|
Increase in Size of Infected Files: 1800 bytes.
|
|
|
|
Nature of Damage: Affects system run-time operation. Corrupts program or
|
|
overlay files. Directly or indirectly corrupts file linkage.
|
|
|
|
Detected by: Scanv36+, F-Prot, IBM Scan, Pro-Scan.
|
|
|
|
Removed by: M_DAV, CleanUp, F-Prot.
|
|
|
|
The Dark Avenger originated in Sofia, Bulgaria, and was probably
|
|
imported to the U.S. in September, 1989 by some visiting math professors
|
|
at U.C. Davis. It was first reported by Randy Dean at the U.C. Davis
|
|
bookstore.
|
|
|
|
It not only infects generic COM and EXE files, but will also infect
|
|
COMMAND.COM. Only files larger than 1,774 bytes will be infected<Note:
|
|
Most of the technical information in this section was provided by Daniel
|
|
Kalchev, of Bulgaria>. Once in COMMAND.COM, the virus will even
|
|
replicate through the DOS COPY and XCOPY commands, with both the source
|
|
and destination files being infected in the COPY process. The virus has
|
|
been named the Dark Avenger because this code appears within the virus.
|
|
The virus contains the words <197> "The Dark Avenger, copyright 1988,
|
|
1989" and the message <197> "This program was written in the city of
|
|
Sofia. Eddie lives.... Somewhere in Time!"
|
|
|
|
The Dark Avenger increases the length of infected COM files by 1,800
|
|
bytes. EXE files are rounded up to the next "paragraph", and the virus
|
|
is appended.
|
|
|
|
The Dark Avenger stays resident in memory (via manipulation of
|
|
memory control blocks) and infects files via many DOS functions (such as
|
|
open, close, exec). For this reason, a file may become infected not only
|
|
when it is executed but even when viewed with PC Tools, when located with
|
|
some "FileFind" program, or when copied with COPY or XCOPY. During copy
|
|
commands, both source and target files become infected.
|
|
|
|
When the Dark Avenger loads into memory, it begins by destroying the
|
|
resident portion of COMMAND.COM, which causes reloading of the transient
|
|
portion. At this time, the virus has already hooked the necessary
|
|
interrupt and COMMAND.COM is infected first.
|
|
|
|
Although it stays resident, the Dark Avenger can't be detected by
|
|
many programs such as MAPMEM, MI, SMAP, and others. This is because when
|
|
a such a program is executed, the virus finds the program's own memory
|
|
control block (MCB) and changes it in a way that it looks like the last
|
|
of the chain of the MCBs (originally the MCB points to the next MCB in
|
|
which virus is located). This hint is especially designed to deceive
|
|
programs such as MAPMEM.
|
|
|
|
In addition, in the boot sector, two variables are maintained (at
|
|
offset 0x08 and 0x0A). The latter is a counter to 15 (initialized to
|
|
major version of current PC/MS-DOS). It is incremented each time an
|
|
infected program is executed. When the counter reaches 16, the number
|
|
from the first variable is used to select a random disk sector, which is
|
|
then overwritten by the virus. If this sector is used by a file, the file
|
|
is destroyed. Should the directory sector be selected and overwritten,
|
|
the results are most unpleasant.
|
|
|
|
When the Dark Avenger installs itself, it scans the ROMs of
|
|
additional controllers to find the address of the INT 0x13 handler (the
|
|
virus knows how it begins and looks for its own first bytes). After that,
|
|
it directly calls this address. As a result, it can't be detected by a
|
|
program waiting for INT 0x13. The Dark Avenger uses INT 0x26 for this,
|
|
and is detected by many antivirus programs (such as ANTI4US) with this
|
|
interrupt. The virus affects functions of PC/MS-DOS such as "SetVector"
|
|
and "Terminate And Stay Resident".
|
|
|
|
If anti-virus software attempts to set some of the virus's vital
|
|
interrupts via "SetVector", the Dark Avenger will prohibit this. If the
|
|
anti-virus software directly changes the vector table, when the software
|
|
terminates (via "Terminate And Stay Resident"), the virus restores its
|
|
vectors.
|
|
|
|
As an extremely infectious virus, treat it cautiously. Power down
|
|
the system with the on/off switch. Re-boot from a write-protected system
|
|
master diskette. Run SCAN or some other scanner to determine the extent
|
|
of infection. The virus could conceivably be widespread. A disinfector
|
|
(M_DAV), written by Morgan Schweers, is available on the National
|
|
Computer Security Association's BBS that can remove this virus.<Note:
|
|
The board number is 202 364-1304.> Be sure to re-scan the disk after you
|
|
think you are finished with disinfection.
|
|
|
|
|
|
ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
|
|
º This document was adapted from the book "Computer Viruses", º
|
|
º which is copyright and distributed by the National Computer º
|
|
º Security Association. It contains information compiled from º
|
|
º many sources. To the best of our knowledge, all information º
|
|
º presented here is accurate. º
|
|
º º
|
|
º Please send any updates or corrections to the NCSA, Suite 309, º
|
|
º 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS º
|
|
º and upload the information: (202) 364-1304. Or call us voice at º
|
|
º (202) 364-8252. This version was produced May 22, 1990. º
|
|
º º
|
|
º The NCSA is a non-profit organization dedicated to improving º
|
|
º computer security. Membership in the association is just $45 per º
|
|
º year. Copies of the book "Computer Viruses", which provides º
|
|
º detailed information on over 145 viruses, can be obtained from º
|
|
º the NCSA. Member price: $44; non-member price: $55. º
|
|
º º
|
|
º The document is copyright (c) 1990 NCSA. º
|
|
º º
|
|
º This document may be distributed in any format, providing º
|
|
º this message is not removed or altered. º
|
|
ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
|
|
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|