369 lines
19 KiB
Plaintext
369 lines
19 KiB
Plaintext
|
|
Please find enclosed a list of known viruses in the UK prepared by
|
|
Joe Hirst of the BCVRC, he is happy that it be distributed as widely
|
|
as possible.
|
|
|
|
Of great interest is the new Fu Manchu variant of the Israeli virus,
|
|
a virus with a slightly embarassing manipulation task!
|
|
|
|
Ps. Joe doesn't have a mail box to date but I will relay any requests,
|
|
comments or information you pass on.
|
|
|
|
D.Ferbrache
|
|
European co-ordinator
|
|
Comp.Virus
|
|
|
|
IMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM;
|
|
: Joe Hirst British Computer Virus Research Centre :
|
|
: 12 Guildford Street, Brighton, East Sussex, BN1 3LS, England :
|
|
: Telephone: Domestic 0273-26105, International +44-273-26105 :
|
|
: :
|
|
: List of known PC viruses :
|
|
: :
|
|
: This list is intended to give enough information to identify a virus :
|
|
: or a variant form of a virus. It is not intended by itself to supply :
|
|
: enough information for a programmer to deal with a virus. If any virus :
|
|
: is found which does not exactly match any of the following descriptions :
|
|
: the Centre requests that a copy of the virus be sent to us, or to a :
|
|
: local researcher known to be in contact with us. :
|
|
HMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM<
|
|
|
|
1. 405
|
|
Parasitic virus - overwriting
|
|
|
|
Type description:
|
|
Virus occurs overwriting the first 405 bytes of a COM file. The virus
|
|
will attempt to infect one COM file on a different disk to the current
|
|
one. If the length of the file to be infected is less than 405 bytes,
|
|
the length will be increased to 405. Due to mistakes in the code it is
|
|
not able to infect other than in the current directory, nor is it able
|
|
to recognise an infected file.
|
|
|
|
-----------
|
|
|
|
2. Brain
|
|
Boot virus - floppy only
|
|
|
|
Type description:
|
|
This virus consists of a boot sector and three clusters (6 sectors)
|
|
marked as bad in the FAT. The first of these sectors contains the
|
|
original boot sector, and the rest contain the rest of the virus. It
|
|
only infects 360K floppies, and it occupies 7K of memory. It creates a
|
|
label on an infected disk of ' (c) Brain '. There are a number of
|
|
unused character strings which can be used to identify it:
|
|
|
|
Offset 0010H:
|
|
' Welcome to the Dungeon '
|
|
' (c) 1986 Basit & Amjad (pvt) Lt'
|
|
'd. BRAIN COMPUTER SERVICES..730 NI'
|
|
'ZAM BLOCK ALLAMA IQBAL TOWN LAHOR'
|
|
'E-PAKISTAN..PHONE :430791,443248,280530. '
|
|
' Beware of this VIRUS.....Contact us for vaccin'
|
|
'ation............... $#@%$@!! '
|
|
Offset 0202H
|
|
'(c) 1986 Basit & Amjads (pvt) Ltd '
|
|
Offset 0355H
|
|
' (c) 1986 Basit & Amjads (pvt) Ltd'
|
|
Offset 04A6H
|
|
' (c) Brain $'
|
|
|
|
Variations:
|
|
All the variations we have so far seen have only involved changes to
|
|
these character strings.
|
|
|
|
(1) Offset 0010H:
|
|
'Welcome to the Dungeon (c) 1986 D.C.L', 17H, '&'
|
|
' Amjads (pvt) Ltd VIRUS_SHOE RECORD v9.0 '
|
|
'Dedicated to the dynamic memories of millions of'
|
|
' virus who are no longer with us today - Thanks '
|
|
'GOODNESS!! BEWARE OF THE er..VIRUS : \thi'
|
|
's program is catching program follows after'
|
|
' these messeges..... $#@%$@!! '
|
|
Offset 0202H
|
|
'(c) 1986 Brain & Amjads (pvt) Ltd '
|
|
Offset 0355H
|
|
' (c) 1986 Brain & Amjads (pvt) Ltd'
|
|
Offset 04A6H
|
|
' (c) ashar $'
|
|
(2) As variation 1 except 'D.C.L' is changed to 'Brain' in string at offset
|
|
0010H
|
|
(3) As variation 2 except 'Brain' is changed to 'Jork ' in string at offset
|
|
0202H
|
|
|
|
-----------
|
|
|
|
3. Cascade - AKA 1701, 1704
|
|
Parasitic virus - resident
|
|
|
|
Type description:
|
|
The virus occurs attached to the end of a COM file. COM files increase
|
|
in length by 1701 bytes. The first three bytes of the program are
|
|
stored in the virus, and replaced by a branch to the beginning of the
|
|
virus. The virus is encrypted (apart from the first 35 bytes) using an
|
|
algorithm that includes the length of the host program, so every sample
|
|
looks different. It becomes memory-resident when the first infected
|
|
program is run, and it will then infect every COM file run (even if the
|
|
file has an EXE extension). If the system date is between October and
|
|
December 1988 the cascade display will be activated at random
|
|
intervals. The virus tests the BIOS for the string 'COPR. IBM', and
|
|
will not infect if it finds this - however there are errors in the code
|
|
which prevent it from working. Because recognition depends on the
|
|
length of the virus, it will infect programs already infected by
|
|
variants with different lengths.
|
|
|
|
Variations:
|
|
(1) COM files increase in length by 1704 bytes. The only differences are
|
|
the removal of a conditional jump (which would never have been taken),
|
|
and some necessary segment overrides on the BIOS tests missing in the
|
|
previous version. There is still a mistake preventing an IBM machine
|
|
from being recognised.
|
|
|
|
-----------
|
|
|
|
4. Datacrime - AKA 1168
|
|
Parasitic virus - non-resident
|
|
|
|
Type description:
|
|
The virus occurs attached to the end of a COM file. COM files increase
|
|
in length by 1168 bytes. The first three bytes of the program are
|
|
stored in the virus, and replaced by a branch to the beginning of the
|
|
virus. The virus will search through full directory structure of the
|
|
disks (in the order C, D, A, B) for a COM file other than COMMAND.COM.
|
|
It will also ignore any COM file if the 7th letter of the name is a D.
|
|
If the date is after 12 October (any year) it will display the message:
|
|
'DATACRIME VIRUS'
|
|
'RELEASED: 1 MARCH 1989'
|
|
and do a low level format on track zero, all heads, of the hard disk.
|
|
Due to mistakes in the code the system is almost certain to crash the
|
|
first time the critical error handler is invoked after the virus
|
|
terminates.
|
|
|
|
-----------
|
|
|
|
5. Dbase [report only - no sample]
|
|
Parasitic virus - resident
|
|
|
|
Type description:
|
|
Infects COM and EXE files. Transposes random bytes of any open .DBF
|
|
file, keeping a record of which bytes in a hidden file (BUG.DAT) in the
|
|
same directory. The virus restores these bytes if the file is read.
|
|
If the BUG.DAT file is 90 days old or more the FAT and root directory
|
|
are overwritten.
|
|
|
|
-----------
|
|
|
|
6. Den Zuk - AKA Search [report only - no sample]
|
|
Boot virus - floppy only
|
|
|
|
Type description:
|
|
Graphics display of 'DEN ZUK', together with the AT&T logo, slides in
|
|
from the sides of the screen on bootup. After five such bootups the
|
|
disk is trashed - no details of how.
|
|
|
|
-----------
|
|
|
|
7. Fu Manchu
|
|
Parasitic virus - resident
|
|
|
|
Type description:
|
|
The virus occurs attached to the beginning of a COM file, or the end of
|
|
an EXE file. It is a rewritten version of the Jerusalem virus, and
|
|
most of what is said for that virus applies here with the following
|
|
changes:
|
|
|
|
a. The code to delete programs, slow down the machine, and display
|
|
the black 'window' has been removed, as has the dead area at
|
|
the end of the virus and some sections of unused code.
|
|
b. The marker is now 'rEMHOr' (six bytes), and the preceeding 'sU'
|
|
is now 'sAX' (Sax Rohmer - creator of Fu Manchu).
|
|
c. COM files now increase in length by 2086 bytes & EXE files 2080
|
|
bytes. EXE files are now only infected once.
|
|
d. One in sixteen times on infection a timer is installed which
|
|
runs for a random number of half-hours (maximum 7.5 hours). At
|
|
the end of this time the message 'The world will hear from me
|
|
again!' is displayed in the centre of the screen and the
|
|
machine reboots. This message is also displayed every time
|
|
Ctrl-Alt-Del is pressed on an infected machine, but the virus
|
|
does not survive the reboot.
|
|
e. There is further code which activates on or after the first of
|
|
August 1989. This monitors the keyboard buffer, and makes
|
|
derogatory additions to the names of politicians (Thatcher,
|
|
Reagan, Botha & Waldheim), censors out two four-letter words,
|
|
and to 'Fu Manchu ' adds 'virus 3/10/88 - latest in the new fun
|
|
line!' All these additions go into the keyboard buffer, so
|
|
their effect is not restricted to the VDU. All messages are
|
|
encryted.
|
|
|
|
-----------
|
|
|
|
8. Italian - AKA Pingpong
|
|
Boot virus - DOS boot sector
|
|
|
|
Type description:
|
|
This virus consists of a boot sector and 1 cluster (2 sectors used)
|
|
marked as bad in the first copy of the FAT. The first of these sectors
|
|
contains the rest of the virus, and the second contains the original
|
|
boot sector. It infects all disks which have at least two sectors per
|
|
cluster, and it occupies 2K of memory. It displays a single character
|
|
'bouncing ball' which interacts with some characters on the screen. It
|
|
will not run on an 80286 or an 80386 machine.
|
|
|
|
-----------
|
|
|
|
9. Jerusalem - AKA 1813, Friday the 13th, PLO, Israeli
|
|
Parasitic virus - resident
|
|
|
|
Type description:
|
|
The virus occurs attached to the beginning of a COM file, or the end of
|
|
an EXE file. A COM file also has the five-byte 'marker' attached to
|
|
the end. This marker is usually (but not always) 'MsDos', and is
|
|
preceeded in the virus by 'sU'. COM files increase in length by 1813
|
|
bytes. EXE files usually increase by 1808 bytes, but the displacement
|
|
at which to write the virus is taken from the length in the EXE header
|
|
and not the actual length. This means that part or all of this 1808
|
|
bytes may be overwritten on the end of the host program. It becomes
|
|
memory-resident when the first infected program is run, and it will
|
|
then infect every program run except COMMAND.COM. COM files are
|
|
infected once only, EXE files are re-infected each time they are run.
|
|
After the system has been infected for thirty minutes an area of the
|
|
screen from row 5 column 5 to row 16 column 16 is scrolled up two lines
|
|
creating a black two line 'window'. From this point a time-wasting
|
|
loop is executed with each timer interrupt. If the system was infected
|
|
with a system date of Friday the thirteenth, every program run will be
|
|
deleted instead. This will continue irrespective of the system date
|
|
until the machine is rebooted. The end of the virus, from offset
|
|
0600H, is rubbish and will vary from sample to sample.
|
|
|
|
Variations:
|
|
(1) [report only - no sample]
|
|
This is almost certainly an earlier variant. The string 'sUMsDos' in
|
|
the type version is 'sURIV 3.00' in this version, the 30 minute delay
|
|
is here 30 seconds, and there is a bug in the program delete.
|
|
|
|
(2) [report only - no sample]
|
|
This is probably the first version. Only COM files are infected, and
|
|
the target date is 1st April. When target date is reached, the trojan
|
|
element is triggered the first time an uninfected file is infected by
|
|
the memory-resident virus. This produces the message 'APRIL 1ST HA HA
|
|
HA YOU HAVE A VIRUS', and the machine locks. Identifying string is
|
|
'sURIV 1.01'.
|
|
|
|
(3) [report only - no sample]
|
|
As variation 2, but only infects EXE files. Trojan is triggered first
|
|
time an infected file is run on 1st April. Additionally, machine locks
|
|
one hour after infection if default date of 1-1-80 is used. Virus
|
|
infects file only once. Identifying string is 'sURIV 2.01'.
|
|
|
|
-----------
|
|
|
|
10. Lehigh [report only - no sample]
|
|
Parasitic virus - overwriting
|
|
|
|
Type description:
|
|
Infects only COMMAND.COM, where it overwrites the stack space. If a
|
|
disk which contains an uninfected copy of COMMAND.COM is accessed, that
|
|
copy is also infected. A count of infections is kept within each copy
|
|
of the virus, and when this count reaches 4 every disk (including hard
|
|
disks) currently in the computer is trashed by overwriting the initial
|
|
tracks (boot sector & FAT). Infection changes the date and time of the
|
|
infected file. If a floppy with an uninfected COMMAND.COM is write-
|
|
protected, there will be a 'WRITE PROTECT ERROR' message from DOS.
|
|
|
|
-----------
|
|
|
|
11. New Zealand - AKA Stoned, Marijuana
|
|
Boot virus - master boot sector
|
|
|
|
Type description:
|
|
This virus consists of a boot sector only. It infects all disks, and
|
|
it occupies 1K of memory. The original boot sector is held in track
|
|
zero, head one, sector three on a floppy disk, and track zero head
|
|
zero, sector two on a hard disk. The boot sector contains two
|
|
character strings: 'Your PC is now Stoned!' & 'LEGALISE MARIJUANA!'.
|
|
The first of these is only displayed one in eight times when booting
|
|
from an infected floppy, the second is unreferenced.
|
|
|
|
Variations:
|
|
(1) Much of the code has been reorganised. The only significant change is
|
|
that the original boot sector is stored at track zero, head zero,
|
|
sector seven on a hard disk. The second string is not transfered when
|
|
infecting a hard disk.
|
|
|
|
-----------
|
|
|
|
12. Oropax - AKA Music virus [report only - no sample]
|
|
Parasitic virus - resident
|
|
|
|
Type description:
|
|
Infects COM files, length increases by 2756-2806 bytes, so that total
|
|
length is divisible by 51. Becomes active (randomly) five minutes
|
|
after infection, playing three different tunes with a seven minute
|
|
interval.
|
|
|
|
-----------
|
|
|
|
13. Pentagon
|
|
Boot virus - floppy only
|
|
|
|
Type description:
|
|
Virus is possibly an honorary term, at least for this sample, as all
|
|
attempts to run it have so far failed. The following describes what
|
|
would happen if it did work (as future samples might).
|
|
This virus consists of a boot sector and two files. The boot sector is
|
|
a normal PCDOS 3.20 boot sector with three changes:
|
|
1. The OEM name 'IBM' has been changed to 'HAL'.
|
|
2. The first part of the virus code overwrites 036H to 0C5H.
|
|
3. 100H-122H has been overwritten by a character string.
|
|
The name of the first file is the hex character 0F9H. This file
|
|
contains the rest of the virus code followed by the original boot
|
|
sector. The name of the second file is PENTAGON.TXT. This file does
|
|
not appear to be used in any way or contain any meaningful data. Both
|
|
files are created without the aid of DOS, and the first file is
|
|
accessed by its stored absolute location. Four different sections of
|
|
the virus are separately encrypted:
|
|
1. 004AH - 004BH, key 0ABCDH - load decryption key
|
|
2. 0059H - 00C4H, key 0FCH - rest of virus code in boot sector.
|
|
3. 0791H - 07DFH, key 0AAH - the file name and copyright message.
|
|
4. 0800H - 09FFH, key 0FCH - the original boot sector.
|
|
The virus will survive a warm boot (Ctrl-Alt-Del). It only infects
|
|
360K floppies, and it will look for and remove Brain from any disk that
|
|
it infects. It occupies 5K in memory.
|
|
|
|
-----------
|
|
|
|
14. Vienna - AKA 648, Austrian, Unesco
|
|
Parasitic virus - non-resident
|
|
|
|
Type description:
|
|
The virus occurs attached to the end of a COM file. COM files increase
|
|
in length by 648 bytes. The first three bytes of the program are
|
|
stored in the virus, and replaced by a branch to the beginning of the
|
|
virus. The virus looks for, and infects, one COM file - either in the
|
|
current directory or in one of the directories on the PATH. One in
|
|
eight files 'infected' does not get a copy of the virus. Instead the
|
|
first five bytes of the program are replaced by a far jump to the BIOS
|
|
initialization routine.
|
|
|
|
Variations:
|
|
(1) This is the version published in Ralf Burger's book 'Computer Viruses:
|
|
A High-Tech Disease'. An error has been introduced which disables the
|
|
virus's ability to search through the PATH, and the far jump has been
|
|
replaced by five spaces.
|
|
|
|
-----------
|
|
|
|
15. Yale - AKA Alameda, Merritt
|
|
Boot virus - floppy only
|
|
|
|
Type description:
|
|
This virus consists of a boot sector only. It infects floppies in the
|
|
A-drive only and it occupies 1K of memory. The original boot sector is
|
|
held in track thirty-nine, head zero, sector eight. It hooks into INT
|
|
9, and only infects when Ctrl-Alt-Del is pressed. It will not run on
|
|
an 80286 or an 80386 machine, although it will infect on such a
|
|
machine. It has been assembled using A86. It contains code to format
|
|
track thirty-nine, head zero, but this has been disabled.
|
|
|
|
-----------
|
|
|
|
|