Shareware Overload/ShartewareOverload.cdr/virus/fprot114.zip/FILVIR-2.TXT

Text File | 1991-01-21 | 38KB | 895 lines

       A description of PC viruses and their symptoms - Part II

                      Jerusalem (Israeli "Friday 13.")

The Jerusalem virus is one of the oldest and most common viruses around.
As a result there are numerous variants of it.  It will infect both .EXE
and .COM files, but the first version of the virus contained a bug,
causing it to infect .EXE files over and over, until they became too
large for the computer.  Needless to say, this has been fixed in later
releases, including one called "New Jerusalem".  Infected files grow by
1808 bytes or so.

The original Jerusalem virus would activate on every Friday the 13th,
deleting programs run on that day.  30 minutes after an infected program is
run, the virus will also cause a general slowdown of the computer and make a
part of the screen scroll up two lines.  This has been disabled in some
variants of the virus, which makes them much harder to detect.

The first variant of the virus (sURIV 3.00) produced the side-effects
described above 30 seconds after an infected program was run.

One variant, "Century" will become active on Jan 1. 2000.  It will try to
delete everything that can be deleted and then display the message

                        Welcome to the 21st Century

The programmer does not seem to have known that the 21st century does not
start until a year later.

The "Sunday" virus is another variant of the Jerusalem virus.  Instead of
activating on Friday the 13th, it will activate if the current day of the
week is Sunday and display the message:

                Today is SunDay! Why do you work so hard?
                All work and no play make you a dull boy!
                Come on! Let's go out and have some fun!

Apart from this the viruses are very similar.  A second variant, Sunday-2
is also known, containing some minor changes.

Other variants include Payday, Anarkia, PSQR, Mendoza, Puerto, Spanish,
Westwood and A-204, which are only different in minor ways - different
activation dates and other minor changes.  Sometimes the changes only
involve the reordering of a few instructions, perhaps to prevent the virus
from being detected by some virus scanning program.  Perhaps the most
unusual variant is "Frere", which is reported to play "Frere Jacques" on
Fridays, when it activates and "Groen Links", a Dutch variant, which
plays a tune whose name translates to "Vote Green Left" ("Green Left" is
a political party there).


                                Jo-Jo

This virus is a 1701 byte, memory resident .COM infector, which is
basically a patched, non-encrypted variant of the Cascade virus.  It
is reported to have originated in Barcelona or Israel.  It contains a check
for the IBM copyright message at address F000:E008, just like Cascade.  The
virus contains two text strings:

                       Welcome to the JOJO virus.

                       Fuck the system (c) - 1990


                                 Joker

This virus is probably extinct, but it originated in Poland, and is 11000
bytes long.  It will overwrite .EXE files, and is therefore easily
detected.  Infected programs will display silly messages when executed,
like
            Water detect in Co-processor
                        I'm hungry  Insert HAMBUGER in drive A:


                                Joker-01

This is also a large Polish virus - 29233 bytes long.  It infects files
in the same way as Vacsina - COM files are infected normally, but EXE
files are converted to files with COM structure, by adding a small, 139
byte loader program to them.


                               July 13th

This virus is designed to activate on July 13th - which happened to fall
on a Friday in 1990.  It is a 1201 byte encrypted .EXE file infector, which
has not been fully dissected yet.


                                Kemerovo

A primitive, 257 byte direct-action Russian virus, which only infects COM
files.  It has not been fully analysed yet.


                                Kennedy

A simple .COM infecting virus, probably from Denmark.  When an infected
file is run, it will infect a single .COM file in the current directory,
adding 333 bytes to the end of the file.  The virus activates on three
dates - June 6th, November 18th and November 22nd. On those dates it will
display the message:

               Kennedy er d¢d - længe leve "The Dead Kennedys"

There have been reports that infection by this virus may cause FAT
corruption, crosslinking of files and loss of clusters, but I have not
been able to verify this.

Another variant is also known - which is one of the shortest virus
known - only 163 bytes long.  This variant seems to do nothing but
replicate.  Like the original Kennedy virus, this variant, which is known as
'Tiny' has only been reported in Denmark. It is somewhat carelessly
written - it does not close the files it opens, for example.


                                Lehigh

The Lehigh virus is rather unusual in that it only infects one program,
COMMAND.COM.  It does not increase the size of the program, because it
overwrites the stack space.  This virus is rather badly written - it can
be defeated by simply making COMMAND.COM read-only.  It is, however, very
destructive.  "Lehigh" contains an infection counter and when it has reached
a specific number of infections it will trash the disk.  This means that the
virus never got a chance to spread much outside Lehigh University.


                                Leprosy-B

The name of the virus is derived from the following message found inside
it.
        ATTENTION!  Your computer has been afflicted with
        the incurable decay that is the fate wrought by
        Leprosy Strain B, a virus employing Cybernetic
        Mutation Technology(tm) and invented by PCM2 08/90.

Infected programs will either display this message or

        Program too big to fit in memory

This is a 666 byte overwriting virus, and disinfected programs must be
deleted, as there is no way to remove the virus.


                                 Liberty

Liberty originated in Indonesia.  It is a resident .EXE and .COM
infecting file, 2857 byte long. The virus code is placed at the end of
the file, but the virus also overwrites the first 120 bytes with
code and the following message:

         - M Y S T I C - COPYRIGHT (C) 1989-2000, by  SsAsMsUsEsL

A second variant, 2867 byte long is also known. The effects of the
viruses are not fully known yet.


                               Lozinsky

This is a Russian, 1023 byte virus, which uses a simple encryption
method.  It only infects COM files, but has not been fully analyzed yet.


                                  MG

MG stands for "Matematicheska Gimnazia", the name of the school in Varna
in Bulgaria where the virus seems to have been written.  This is a 500
byte .COM virus, which hides itself in the upper half of the interrupt
table, causing programs like Netware to crash.

                                 MG-3

A 500 byte virus, which only infects .COM files.  Awaiting analysis, but
is probably related to the MG virus.



                                  MGTU

A very simple, 273 byte Russian virus. It does not remain resident in
memory, but will infect COM files when infected programs are run.


                                  MIX1

MIX1 was probably written in Israel, but it is derived from the Icelandic
virus. There are two versions known, MIX1 and MIX1-B, practically identical.
MIX1 displays a bouncing ball on the screen, and garbles all output going
to the printer.  It will also disable the NumLock key. MIX1 is larger than
the Icelandic virus - 1618 or 1636 bytes, depending on the version.

One unusual "feature" of MIX1 is that it will only infect files 8192 bytes
long or larger.


                                MLTI

This 830 byte Russian virus contains the text:

    Eddie die somewhere in time!
    This programm was written in the city of Prostokwashino
    (C) 1990   RED DIAVOLYATA
    Hello! MLTI!

The text is more understandable if one considers the similar text found
in the "Eddie" virus written by Dark Avenger.


                               Murphy

The authors of this virus are known.  They are Lubomir Mateev Mateev and
Iani Lubomirov Brankov, both in Bulgaria.  Murphy is a 1277 byte long,
resident .COM and .EXE infecting virus.  It is based on the Dark Avenger,
but is not harmful.  Inside it the following message can be found.

   Hello, I'm Murphy. Nice to meet you friend. I'm written since Nov/Dec.
   Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory.

Another variant is also known.  It is a bit longer, 1521 bytes, and the
message is different:

   It's me - Murphy.  Copywrite (c)1990 by Lubo & Ian, Sofia, USM Laboratory.

Originally this virus was reported to jump into ROM basic every exact
hour, possibly causing some clones to "hang", but the variant available
to researchers in the West produces the "Bouncing Ball" effect every time
INT 18 is executed.


                              Nina

This virus is only 256 bytes long, and derives its name from a the text
string found at the end, which says simply "Nina".  Like many other small
viruses, this one is written in Bulgaria.


                           Nomenklatura

This virus appears to be of Bulgarian origin, as it contains a message in
Bulgarian.  This is a 1024 byte virus, which corrupts data on the disk,
by modifying the FAT.


                         Number of the Beast

Like quite a few other viruses, this one was first reported in Bulgaria.
It is 512 bytes long, but the length of infected files does not appear
to increase.  This is because the virus overwrites the first 512 bytes of
the programs it infects with itself, and stores the original 512 bytes
in the unused space after the end of the file.  This is possible because
DOS allocates file space in "clusters", which are usually 1024 or 2048
bytes long.

In addition, if a program attempts to read from an infected file, while
the virus is active in memory, the read operation will be intercepted and
instead of finding the virus, the original code will be read instead.

This means that the virus will be able to fool any checksum program, as
well as any virus-scanning program if it is active in memory when the
program is run.  It does not matter how sophisticated the checksum
algorithm is - if the virus is active in memory, no infected program
can be detected.  F-DRIVER will, however, stop the virus.

At the end of the virus code, the string "666" appears - hence the name.
Several new variants are also known in Bulgaria, where this string is
missing, but they are functionally identical.


                              Old Yankee

There is some confusion regarding the various "Yankee Doodle" viruses.
They all originated in Bulgaria and play the tune "Yankee Doodle", but their
structure is different.  This is the first one.  It only infects .EXE files,
increasing their length by 1961 bytes.  When an infected program is run,
the virus will search for a non-infected file.  When it has been
infected, the virus plays the melody, before the original program is
executed.  At the very end of the virus, the word "motherfucker" appears.

Another version of the same virus is also known. The main difference is
the length - the variant is only 1624 bytes long.


                                Oropax

This virus probably originated in W. Germany.  It is not very harmful -
when it activates it will just repeatedly play three melodies. The virus
infects .COM files, other than COMMAND.COM.  Infected files grow by
2756-2806 bytes, becoming a multiple of 51 bytes in length.  This virus
stays resident in memory, but it will not infect other programs when they
are executed.  Instead it will search for a file to infect when files are
created or deleted, a subdirectory is created or the access mode of a
file is changed.  A few other functions may also trigger an infection.

The virus uses a random number generator to decide when to become active,
and if it does, it will start playing 5 minutes after an infected program
is run.


                                 Parity

This is a simple, 441 byte virus, which will infect one .COM file when an
infected program is run.  The virus may emulate a parity error,
displaying

                          PARITY CHECK 2

on the screen and halting the computer.


                                Perfume

A .COM infecting virus of German origin, that will sometimes ask the user a
question and not run the infected file unless the answer is "4711", which
is the name of a perfume.  This virus will look for COMMAND.COM and infect it
unless it is already infected.  Infected files grow by 765 bytes.  In the
most common variant of the virus the questions have been overwritten with
garbage.

                               Phoenix

This is a family of viruses from Bulgaria, containing 1226, Proud (1302),
Evil (1701) and Phoenix (1704). They all infect .COM files, and use a
complicated encryption method, which complicates detection somewhat.


                              Piter

This 529 byte Russian virus has not been analysed yet, but it infects
only COM files, overwriting the beginning of the programs, and placing
the original code at the end of the infected file.


                           Plastique (AntiCAD)

This is a family of viruses from Taiwan.  They are members of the Jerusalem
family, perhaps based on the Fu Manchu variant, but are long - one 2900,
one 3012 and three 4096 byte variants.  One of the 4096 byte variants is
also known as "Invader".  The 4096-byte variants also contain code for
infecting the boot sector.  The reason the viruses are also known as
AntiCAD is that they are targeted against the AutoCAD program.  When a
program named ACAD.EXE is run or sometimes when Ctrl-Alt-Del is pressed, the
viruses will activate, overwriting data on floppy disks and hard disks,
as well as garbling the contents of the CMOS.


                              Polimer

The name of this virus is derived from a text message which infected
programs may display when executed:

           A le'jobb kazetta a POLIMER kazetta !   Vegye ezt !

The virus is a simple, 512 byte .COM infector, which seems to be based
partially on the Vienna virus.


                            Pretoria (June 16th)

Pretoria is a direct-action, .COM infecting virus from South Africa.
It overwrites the first 879 bytes of infected files with itself, and
stores the original 879 bytes at the end of the file.  This makes it
impossible to fully restore programs shorter than 879 bytes, as their
original length is not stored anywhere.

When an infected program is executed, the virus searches the entire current
directory for .COM files to infect.  As it uses a full-depth recursive
directory search, this may take considerable time on an XT-class machine.

On June 16th the execution of an infected file will cause all entries in the
root directory to be changed to 'ZAPPED'.  June 16th is the day when the
Soweto riots first broke out.

The virus uses a simple substitution encryption.


                                Prudents

This is a Direct-Action Spanish virus, 1205 bytes long, which infects
.EXE files.  It is probably written by the same author as the PSQR variant
of the Jerusalem virus, as it checks if that virus is present, when it is
run. This virus will overwrite the last 32 bytes of any file it infects,
possibly destroying the victim.  The virus activates on May 1st - May 4th
of any year, interfering with disk writes.


                                 Saddam

This virus is based on the Stupid virus, and is also from Israel.  It is
919 byte long.  The most obvious effect of the virus is to display:

        HEY SADDAM   LEAVE QUEIT BEFORE I COME



                                  Shake

Thake is a primitive 476 byte .COM infecting virus.  It may infect the
same program over and over, and infected programs may cause a reboot when
executed.  The name is derived from a string which is found inside the
virus:
                       Shake well before use !

This message is occasionally displayed when an infected program is run,
followed by termination of the program.


                                  Slow

This is a variant of the Jerusalem virus from Australia.  Some reports
indicate it may cause a slowdown of the system, but this has not been
confirmed.  The length is 1716 bytes, with extra 5 bytes added at the end
of .COM files.  The major difference between this virus and the standard
Jerusalem virus is the use of a simple encryption in the Slow virus.  A
variant of Slow has been reported in California. This 2126 byte variant
is known as "Scott's Valley".


                           South African "Friday 13."

This is one of the oldest viruses around, but it is very rare.  In fact,
it may even be extinct, apart from copies in the hands of virus researchers.
It is a "direct action" virus, that will seek out one or more programs to
infect, every time an infected program is run.  It will only infect .COM
files, which grow by 415-544 bytes, depending on the variant in question.
The original virus is 419 bytes long.  Like the Lehigh virus it can be
stopped simply by making .COM files read-only.  Most other viruses are not
bothered by this, however.  A version of this virus, called "Virus-B",
where the destructive part has been disabled has been distributed for
demonstration purposes.


                           Stupid (Do-Nothing)

The "Do-Nothing" or "Stupid" virus is not a well written one.  In fact it
is so badly written that in many cases it will simply cause the system to
"hang", instead of properly infecting it.  It seems that this virus was
created by a lousy programmer, somewhere in Israel.  It is not a serious
threat.  It will only work on machines with at least 640K of memory,
because it always tries to hide itself at the same address, starting at
9000:0000.  This virus infects .COM files, which grow by 583 bytes.  The
original infected program distributed by the author contained the string:

                        (c)Stupid 1989 Virushmock!

A variant of this virus, also from Israel, is somewhat longer - 919
bytes. It is known as the "Saddam" virus, because of the following text
message:

                         HEY SADDAM
                         LEAVE QUEIT BEFORE I COME


                                Subliminal

As this wirus vas found close to where the Dyslexia was discovered and as
the viruses are clearly related, they are believed to have been written
by the same person - "Subliminal" probably just being an earlier version
of the same virus.  The Subliminal virus derives its name from its
activity - it will continously display the text "LOVE, REMEMBER?" for a
fraction of a second in a corner of the screen.


                               Suomi

This is an encrypted 1008 byte virus from Finland.  It infects COMMAND.COM
as soon as an infected program is run.  The virus has not been fully
analyzed yet.


                             Superhack

This is a 1077 byte virus, which infects .COM files in an ordinary way,
but .EXE files are infected in a similar way, which prevents the virus
from infecting .EXE files longer than 64K.  The virus was written in
Scotland and is known there as "Murphy".


                               SVC

This is the first Russian "stealth" virus.  It is 1689 bytes long and
infects COM and EXE files.  It has not been analysed yet, but it contains
the text string:

                      (c) 1990 by SVC,Vers. 4.0


                  Sverdlov

This is an encrypted, 1962 byte Russian virus, which was first discovered
in Sverdlov.  It is reported to display a moving banner across the
screen, while playing the Russian national anthem.  Afterwards drive C:
is reported to be inaccessible and a low-level format is required to make
it usable again.


                                Svir

This is an unremarkable 512 byte direct-action .EXE file virus.  Its
effects (if any) are not yet known.


                               Sylvia

This virus is a bit unusual, to say the least.  It contains the following
message:

              This
                 program
                        is
                          infected
                                  by
                                    a
                                     HARMLESS
                                             Text-Virus V2.1

             Send a FUNNY postcard to : Sylvia Verkade,
                                        Duinzoom 36b,
                                        3235 CD Rockanje
                                        The Netherlands.

             You might get an ANTIVIRUS program.....

It will display this message when an infected program is executed, but if
the above text is tampered with, the following message, (which is stored in
an encrypted form) will appear instead:

                     FUCK YOU LAMER !!!!

                     system halted...$

Some people have a weird sense of humor...

As the text above indicates, the virus originated in the Netherlands.
When an infected program is run, the virus will seek out up to 5 .COM files
to infect.  It will search drive C: and the current drive.  The three system
files, COMMAND.COM, IBMBIO.COM and IBMDOS.COM are not infected.  The virus
adds 1301 bytes to the beginning of the files it infects (and also 31 bytes
to the end), but does no other damage.  The girl mentioned above exists,
but she says that she has no idea who the author is.  It is very likely that
he knows her, though.


                               SysLock

The SysLock virus infects .EXE and .COM files.  It is a "Direct Action"
virus that will search for files to infect when an infected program is
executed.  The virus will first modify the length of any program it
infects, so it becomes a multiple of 16 bytes.  Then the virus code, 3551
bytes is appended to the file.

One unusual "feature" of this virus is that it will search the disk for
the string "Microsoft" and change it into "MACROSOFT". The virus will not
infect programs if the environment contains SYSLOCK=@.

Four other variants of this virus are known.  Two are called "Macho",
since they both will change the string "Microsoft" into "MACHOSOFT".  One
is very close to the original virus, the other a bit different.  The third
variant, "Advent" will activate in December and then play "Oh, Tannenbaum".
The last variant is 2232 bytes long and known as "Cookie", because it may
display the message

                         I want a COOKIE!


                                 Taiwan

This virus seems to have appeared in Jan '90. It is a direct-action .COM
infector, which activates on the 8th day of any month, overwriting the FAT
and root directory of drives C: and D:  Two variants are known, one is
708 bytes, but the other one is 743.  Infected programs sometimes "hang",
for some unknown reason.


                               Tenbyte

This is a 1554 byte long .COM and .EXE infecting virus that was by
accident posted to the V-ALERT electronic mailing list, which is intended
for urgent messages regarding virus infections.  Just like the "Stupid"
virus, it will only work on machines with at least 640K memory.  It
activates on September 1st, and stays active until December 31st.  While
active, it will corrupt all disk writes, deleting the first ten characters
of any data written to the disk and add ten "garbage" characters at the
end.  This will cause destruction of data files, as well as preventing
the compilation of any programs.


                                Traceback

The "Traceback" virus produces a screen display similar to that produced
by the Cascade virus.

There are of course differences, since the viruses are totally unrelated.
Every file infected with "Traceback" contains the name of the file that
infected it.  This makes it possible to trace the path of the infection.

Another difference is that it is possible to make the characters "jump"
back up, by pressing keys on the keyboard, after all the characters on
the screen have fallen down.

There are two variants known of this virus, but the size is the only
significant difference.  The original virus is 3066 bytes long, but the
variants are 2930 and 3031 bytes long.


                                   TUQ

This is a simple, non-remarkable, 453 byte long .COM infecting virus,
probably written in Germany.  It has no effects other than replication.


                               Turbo

The name of the virus is derived from a text string contained inside it.
The virus family contains two viruses, one 512 byte known as "Turbo Kukac",
but the other as Turbo-448.  Both viruses only infect COM files, and
may cause program crashes.  For example, COMMAND.COM will always crash if
infected.


                                  Turku

This is one of two viruses from Finland, the other being the "Suomi"
virus.  It will infect .COM and .EXE files.  The length of the virus is
either 1232 or 1472 bytes, depending on the file type.  No interesting
effects have been observed, other than occasional "repeats" of certain
keys, when pressed.


                        Vacsina and Yankee Doodle

A programmer in Bulgaria has written a number of viruses - 50 different
variants or so. Two of the variants, number 5 and 39 "escaped" to the
West in 1989.  One of the features of virus in this family is that they
contain a version number system, similar to that used in the "Den Zuk"
virus. If a virus in the family finds a file infected with an older version
of itself, it will remove the infection and re-infect with the new version.

A number of the variants play the tune "Yankee Doodle", but the viruses
are not to be confused with the original "Yankee Doodle" virus, which is
called "Old Yankee" by the F-FCHK program.

This family can be divided into two groups, one consisting of versions
numbered below 38, but the other one versions 38 and upwards.  The first
group is identified as "Vacsina" variants by F-FCHK, and the second one
as "Yankee Doodle" variants.  However, this division is based on
differences in the internal structure of the viruses - several of the
"Vacsina" viruses also play "Yankee Doodle".

The "Vacsina" viruses seem to have been written originally to infect only
.COM files.  .EXE files are also infected, but that is done in two steps.
First a short piece of code is added to the end of the file. Then a JMP
command is added at the front of the file.  This code seems to be based on
the code used in FORMAT.COM and CHKDSK.COM in some versions of MS-DOS.
When executed it will relocate the .EXE file.  This makes the .EXE file
structurally equivalent to a .COM file, so it can be infected as one.

The second group (versions 38 and upwards) infects .EXE files in a
"ordinary" way.

Compared to most other viruses, these are fairly harmless. In the first
versions a beep (BELL) is heard, every time a .COM-type file is successfully
infected.  As mentioned before, some of them play "Yankee Doodle", sometimes
at 5 o'clock, but other variants play the tune when the computer is rebooted
by pressing Ctrl-Alt-Del.

The latest versions of the viruses contain several advanced features -
including self-correcting Hamming code, disabling of debugging tools, and
the ability to search for and remove the Ping-Pong and Cascade viruses.

One related virus is also known, but it is shorter than any of the Yankee
viruses, only 1049 bytes long.  It seems to have been created by removing
parts of the "Yankee" code.


                                    Vcomm

An .EXE infecting virus that came from Poland.  It is not very well written, but
easy to study because the commented source code was included in the sample
that arrived from there.  When an infected program is run, it will infect one
.EXE file in the current directory.  Infected programs are first padded so
their length becomes a multiple of 512 bytes.  Then the virus adds 637 bytes
to the end of the file.  It will also install a resident part that will
intercept any disk write and change it into a disk read.

                   VFSI (Happy)

This virus is believed to have been written by a student at the
"Vish Finansovo-Stopanski Institut" in Bulgaria.  It is a small, 437
byte, direct-action .COM-infecting virus.  It can be stopped by making
files read-only.  When it activates, it may display the following
messages.

                     HELLO!!! HAPPY DAY and SUCCESS
                     from virus 1.1 VFSI-Svistov


                                     Victor

This is a 2442 byte .EXE and .COM virus from the USSR, at least according
to the text found inside it:

        Victor V1.0 The Incredible High Performance Virus
        Enhanced versions available soon.
        This program was imported from USSR.
        Thanks to Ivan

Little is yet known about its effects.


                                     Vienna

This virus, also called DOS-62, UNESCO and 648 will only infect .COM files.
When an infected file is run, the virus will search for an uninfected file
and infect it.  One out of eight files infected is destroyed, by overwriting
the first few bytes with instructions that will cause a restart when the
program is run.

Infected files can be easily found because they contain an "impossible"
value (62) in the "seconds" field of the time stamp.

Unfortunately the source code to this virus has been published in a book:
"Computer viruses: A High-Tech Disease", so it will probably become very
common in the future.  This version was modified slightly, in order to
make it a little less harmful - it would only infect files in the current
directory.

The virus appends 648 bytes to the files it infects, but a 646 byte
variant is also known.

One variant of this virus, "Lisbon", has been found in Portugal.  It has
clearly been modified and reassembled - probably in order to fool
signature-type anti-virus programs.  This virus overwrites the beginning
of the programs it destroys with "@AIDS".  The GhostBalls virus is also closely
related.  Several other variants have been reported in Bulgaria. Some of them
are so different that they have received a new name, "New Vienna".  The
Bulgarian variants are similar to the original virus, but the changes include:

        Different length - 435,367,354 and 348 bytes.
        Different damage function - formatting of hard disk.
        Critical error handler added.

Other variants exist as well.  One, named 'Violator' is 1055 bytes long,
and it contains the following text strings:

        TransMogrified (TM) 1990 by RABID N`tnl Development Corp.
        Copyright (C) 1990 RABID !
        Activation Date: 08/15/90 - Violator Strain B
        (Field Demo Test Version) *NOT TO BE DISTRIBUTED*

The text seems to indicate the existence of another version, which has
not yet been reported anywhere.

Perhaps the most unusual variant is "Father Christmas" or "Choinka",
which was discovered in Poland.  It is 1881 bytes long, with most of the
extra length devoted to a Christmas greeting.  The Monxla or "Time"
variant is 939 bytes long, and has different effects, depending on the
exact time when it activates.


                                    Virdem

This 1336-byte, direct action .COM-infecting virus was written in 1986,
which makes it one of the oldest viruses in existence.  It was written
by R. Burger, the author of "Computer Viruses: A High-Tech Disease". It
will not spread unless modified, because the virus makes it quite clear
that the program has been infected.  Virdem overwrites the first part of
the program and appends the original code to the end of the file.  At
least two variants of this virus are known - one with all the text strings
in German, but the other is an English language version.  In addition, a
modified 792 byte variant is also known, where all the text messages have
been removed.


                                    Virus-90

The most interesting fact regarding this virus is that the author of it
is known. He uploaded the virus to a number of BBS, saying that the
source code was available for around $20. The virus is a simple .COM
infector that adds 857 bytes to any file it infects.  It will only infect
files on drive A: and B: but it would be easy to "fix" that. An infected
program will display the message "Infected!" when it is executed, but
otherwise the virus does nothing at all.  The virus was uploaded for
educational purposes, according to the author, but has now been removed.

A "new and improved" version, Virus-101 also exists.  It infects .EXE
files as well as .COM files, and is somewhat variable.  Some attempts were
made to make it difficult to disassemble or modify the virus, but this
"protection" is easily defeated.  The virus contains one unusual feature,
it infects COMMAND.COM by overwriting it, in the same manner as the Lehigh
virus does, so no change in length is visible.  Unlike Virus-90, this
virus was not made publically available.


                                 Voronezh

This is a 1600 byte virus from Eastern Europe, which infects COM and EXE
files.  It overwrites the beginning of COM files, placing the original code
in encrypted form at the end.  EXE files are also infected in an unusual
way - the original CS:PC is not changed, but the first 5 bytes of the
program code are overwritten with a FAR CALL to the virus code.  A
related virus, 600 bytes long is also known, but it is only able to
infect COM files.


                                      VP

First reported in April '90, this virus is of the direct-action .COM
infecting kind.  It contains one unusual feature - at the beginning of the
virus a variable number of NOP instructions (0-15 in number) are added.
This is probably done in order to confuse "on-the-fly" virus scanners.
The virus then appends 909 bytes containing the virus code.


                                      W13

This is a rather primitive .COM infecting virus. Two variants are known,
the first one is 534 bytes long, but the second, with some bugs corrected,
is only 507 bytes long. The variants are both of the "Direct Action" type and
do nothing interesting. They are based on the Vienna virus, but mark
infected files by setting the "month" field to 13, instead of setting the
"seconds" field to 62.  This virus originated in the Soviet Union.


                                    Whale

This is a recent, rather remarkable virus.  It is long, 9216 bytes and
able to infect COM and EXE files.  The increase in file size is not
visible though, while the virus is active in memory, as it uses several
advanced "stealth" methods.  Other effects of the virus are not known,
but one infected program displayed the following message when run:

             THE WHALE IN SEARCH OF THE 8 FISH
             I AM '~knzyvo}' IN HAMBURG addr error D9EB,02

Most of the virus is devoted to encryption and code which moves blocks of
virus code around.  This overhead results in a considerable slowdown of
infected systems.


                                  Wisconsin

Like the AntiPascal viruses, this one is targeted against Pascal
programs.  It even includes the string

                                 Death to Pascal

in encrypted form.  The virus is 825 byte long and only infects .COM
files.


                                     XA1

The XA1 virus overwrites the first 1539 bytes of infected .COM files with
itself and stores the original code at the end of the file.  On April
1st, a part of the virus will activate - overwriting the boot sector with
code that will cause the computer to "hang" on next boot-up.  The virus
will also activate on December 21st and stay active until the end of the
year.  It will then display a Christmas tree, and the text:

        Und er lebt doch noch: Der Tannenbaum! Frohe Weihnachten

                                  Zero Bug

The "Zero Bug" will mark infected files in the same way as the Vienna
virus, placing 62 in the "seconds" field of the timestamp of the .COM
files it infects.  Apart from this, the viruses are very dissimilar.

This virus will search for COMMAND.COM, using the value of the COMSPEC
environment variable to locate the file.  Then it will remain resident,
hook INT 60 and infect every .COM file run.  After some time has passed,
a "smiley" (ASCII 1) will appear on the screen and "eat" any zero it
finds on the screen.

The virus seems not too well written - containing some unreachable code,
but it is unusual in some ways.

When it infects a file, it will add 1536 bytes in front of the original code,
just like the Agiplan virus.  It also contains one "feature" that will
probably be more used in the future - if the virus is active in memory and
you look at a directory containing infected files, the virus will make
the directory entries appear as they were before the infection. That is,
you will not see any increase in file length. This method is also used by
some of the latest viruses from Bulgaria.


                            Zero Hunt (Minnow)

This virus infects programs by overwriting them, but unlike most
overwriting viruses it will generally not destroy the host program. This
is because it will only overwrite unused areas within the program.  The
virus searches for a block of at least 416 zero bytes, and places itself
there.  As such programs are rare, this reduces the chances of the virus
spreading.