
             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************


  CASCADE SERIES
  ==============

  Version 1 (1701 bytes):

  The virus occurs attached to the end of a COM file.  COM files
  increase in length by 1701 bytes.  The first three bytes of the
  program are stored in the virus, and replaced by a branch to the
  beginning of the virus.  The virus is encrypted (apart from the
  first 35 bytes) using an algorithm that includes the length of the
  host program, so every sample looks different.  It becomes
  memory-resident when the first infected program is run, and it will
  then infect every COM file run (even if the file has an EXE
  extension).  If the system date is between October and December 1988
  the cascade display will be activated at random intervals.  The
  virus tests the BIOS for the string 'COPR. IBM', and will not infect
  if it finds this - however there are errors in the code which
  prevent it from working.  Because recognition depends on the length
  of the virus, it will infect programs already infected by variants
  with different lengths.


  Version 2 (1704 bytes):

  COM files increase in length by 1704 bytes.  The only differences
  from Version 1 are the removal of a conditional jump (which would
  never have been taken) and some necessary segment overrides on the
  BIOS tests missing in the previous version.  There is still a
  mistake preventing an IBM machine from being recognised.


  Version 3 (1704 bytes):

  Same as Version 2 but has been modified, without recompiling, to
  format the hard disk.  The formatting routine from Datacrime (1) has
  been written over the cascade display, and the activation routine
  changed to 1st October to 31st December, any year except 1993.
  Formatting will be after a random interval, maximum 5 minutes.

==== Computer Virus Catalog 1.2: Autumn Virus (July 15, 1989) ========

Entry...............: Autumn (Leaves) Virus
Alias(es)...........: Blackjack =1704- =Herbst(laub)= Cascade A-Virus
Virus Strain........: Cascade- = Autumn- =Herbst-Virus
Virus detected when.: September 1988
              where.: University of Konstanz, FRG
Classification......: Program Virus (extending .COM), RAM resident
Length of Virus.....: .COM filelength increases by 1704 byte
-------------------- Preconditions -----------------------------------

Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles

-------------------- Attributes -------------------------------------

Easy Identification.: ---
Type of infection...: System: is infected if the call of interrupt 21h
                      with function 4Bh and subfunction FFh is
                      possible and without error and 55AAh is returned
                      in DI- register.

                      .COM file: Program virus, increases COM files by
                      1704 Byte. A .COM file is infected if the first
                      instruction is a three byte jump with DISP16 =
                      (filelength minus viruslength).

                      .EXE file: no infection.

Infection Trigger...: Infects all files that are loaded via the
                      function 4Bh and subfunction 00h of the
                      interrupt 21h (MS-DOS uses this function to
                      start any program)

Interrupts hooked...: Int21h, Int28h (only if Clockdevice Year =
                      1980), Int1Ch (only if damage is triggered)

Damage..............: Transient Damage: Modifies screen by making the
                      characters on the screen "fall down" on the
                      screen in connection with clicking noises.

Damage Trigger......: IF function GetDate returns with
                         1. ( year=1988 AND month>= 10 ) OR
                         2. ( year=1980 AND
                         2.1. clock is changed by user to year=1988
                                month>=10 OR
                         2.2. clock is changed by user to year>1988 )
                      AND a random number generator activates damage.

Particularities.....: 1. If the system is _not_ infected, the
                         invocation of an infected program produces
                         errors (system crash is possible).

                      2. COM-files up to a length of 63800 bytes will
                         be infected, but files with a length of more
                         than 63576 bytes are not loadable after
                         infection.

                      3. The virus-program is encoded, dependent of
                         the .COM-filelength.

                      4. The distinction between .EXE and .COM files
                         is made by testing the "magic number (MZ)" in
                         the .EXE-Header.

------------------- Agents -----------------------------------------

Countermeasures.....: Category 3: ANTIHBST.EXE (VTC Hamburg)

Countermeasures successful: ANTIHBST.EXE is an antivirus that only
                            looks for the HERBST-virus and, if
                            requested, will restore the file.

Standard means......: ---

------------------- Acknowledgement --------------------------------

Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Michael Reinschmiedt
Documentation by....: Michael Reinschmiedt
                      Morton Swimmer
Date................: July 15, 1989


=================== End of Autumn-Virus ============================


  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
