
             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************
 
 
==== Computer Virus Catalog 1.2: OROPAX-Virus (July 15, 1989) =======

Entry...............: OROPAX Virus
Alias(es)...........: Music Virus
Virus Strain........: ---
Virus detected when.: February 1989
Classification......: Program Virus (extending), Direct Action,
                      RAM-resident
Length of Virus.....: COM-files: length increased by 2756-2806 Byte,
                                 always divisable by 51.

-------------------- Preconditions ----------------------------------

Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles

-------------------- Attributes ------------------------------------

Easy Identification.: Typical texts in Virus body (readable with
                      HexDump facilities):  "????????COM" and
                      "COMMAND.COM"

Type of infection...: System: RAM-resident, infected if function 33E0h
                         of interrupt 21h returns 33E0h in
                         AX-register.  .COM File:  extending by using
                         FindFirst/FindNext- function in the home
                         directory until a COM File is encountered
                         with a different Attribute than N or A.
                         Files are only infected once.

                         The following .COM-files will not be
                         infected:

                         - COMMAND.COM,
                         - COM files with length divisible by 51,
                         - COM file with an attribute other than N or
                           A,
                         - COM files longer than 61980 Bytes.

                         .EXE File:  no infection.

Infection Trigger...: When any of the following INT 21h functions:
                         39h, 3Ah, 3Ch, 3D01h, 41h, 43h, 46h, 13h,
                         16h, or 17h are called; these functions are
                         also used by other resident DOS commands,
                         e.g.  MD, RD, DEL, REN, and COPY.

Interrupts hooked...: INT08h, INT20h, INT21h, INT27h

Damage..............: Transient Damage: After 5 minutes, the virus
                         will start to play three melodies repeatly
                         with a 7 minute interval in between.  This
                         can only be stopped with a reset.  OROPAX and
                         earcaps can be used to avoid "music
                         overload".

Damage Trigger......: Using a random number generator, the virus
                         decides whether to become active.

--------------------- Agents ---------------------------------------

Countermeasures.....: Category 3: ANTIORO.EXE (VTC Hamburg)

Countermeasures successful: ANTIORO.EXE finds and restores infected
                      programs (only for OROPAX).

Standard means......: notice .COM file length

-------------------- Acknowledgement --------------------------------

Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Thomas Lippke
Documentation/Translation: Morton Swimmer
Date................: July 15, 1989

==================== End of OROPAX-Virus ===========================

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
