
             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************
 
 
== Computer Virus Catalog 1.2: "Devil's Dance" Virus (5-June-1990) ===

Entry...............: "Devil's Dance"
Alias(es)...........: "Devil","941 Virus"
Virus Strain........:
Virus detected when.: Spring 1990
              where.: Mexico City
Classification......: .COM - file: extending, RAM-resident, link virus
Length of Virus.....: .COM - Files: increased by 941 bytes

--------------------- Preconditions ----------------------------------

Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM - PC, XT, AT and compatibles

--------------------- Attributes -------------------------------------

Easy Identification.: Typical text in Virus body, readable with
                      hexdump-utilities: "Drk", "*.com". If the high-
                      bit of the displayed code is stripped, the mes-
                      sage displayed at system reset time can be read.
                      .COM files: the first three bytes (jmp) and
                      the last three bytes are identical.
                      The file date/time is set to the date/time of
                      the infection (i.e. multiple infected files
                      have the same file date/time).

Type of infection...: System virus: RAM-resident: infected if at the
                      location 3 bytes before INT 21-adress the string
                      "Drk" is found.
                      .COM file: infected by hooking LOAD-function;
                      adds 941 bytes to the end of the file.
                      Only files with extension .COM will be infected.
                      A file will be infected more than once.
                      At first execution of the virus, all .COM files
                      in the current directory will be infected.
                      .EXE File: no infection.

Infection Trigger...: .COM file will be infected, when function 4B00H
                      (LOAD/EXEC) of INT 21H is called.

Interrupts hooked...: INT 21H (functions 4B00H and 49H).
                      INT 09H only for damage.

Damage..............: Permanent Damage:
                      1. Every .COM file executed in an infected
                         system will be infected.
                      2. After pressing 2,500 keys and reset=
                         <CTRL>+<ALT>+<DEL>, the first sector of
                         the hardisk C: will be overwritten.
                      Transient Damage:
                      1. All characters typed will be displayed in a
                         different color on a color card.
                      2. If reset=<CTRL>+<ALT>+<DEL> is pressed, the
                         following message is displayed:
                         "Have you ever danced with"
                         "the devil under the weak light of the moon?"
                         "Pray for your disk!  The_Joker..."
                         "Ha Ha Ha Ha Ha Ha Ha Ha Ha Ha".

Damage Trigger......: Keyboard input (characters typed) and
                        reset=<CTRL>+<ALT>+<DEL>

Particularities.....: - The message "Have you ... Ha Ha"  is
                        encrypted.
                      - All files with .COM extension will be
                        infected
                        (i.e also exe-files with .COM extension).
                      - .COM files with exe-header-id "MZ" will not
                         run after infection.
                      - Virus does not use a self-identification on
                        .COM files; files will be infected many times.
                      - In case of multiple infections of .COM files,
                        system is slowed down on first execution of
                        the virus in a clean system; if, e.g., a file
                        has been infected 10 times, then it will try
                        to infect any accessible .COM file 10 times.
                      - All file attributes are cleared/not restored.
                      - Multiple files have the same date/time.
                      - Programs longer than 64,337 bytes are not exe-
                        cuted correctly after infection.

-------------------- Agents ------------------------------------------

Countermeasures.....: Category 3: NTIDEVIL.EXE (VTC Hamburg)

- ditto - successful: NTIDEVIL.EXE finds and restores infected
                      programs.

Standard means......: Notice .COM file length, file
                      date/time/attribute.  Typical text in virus
                      body:  "*.com", "Drk" .  Search for hex bytes:
                      E4,E1,EE,E3,E5,E4,A0,F7,E8, F4,E8.Don't use
                      <CTRL>+<ALT>+<DEL> if your screen has been
                      colored; use power-off- or reset-switch to
                      reboot your computer.

-------------------- Acknowledgement ---------------------------------

Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Stefan Tode
Documentation by....: Stefan Tode
Date................: 5-June-1990


==================== End of "Devil's Dance"-Virus ====================


  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
