ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/PCV4RPT.ZIP/DARKAV-2.RPT

Text File | 1991-05-28 | 10.0 KB | 193 lines

             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************


  DARK AVENGER 2000
  =================

  Date:    02 Feb 90 10:49:00 +0700
  From:    Vesselin Bontchev

  This virus is also "made in Bulgaria" and again I am indirectly the
  cause of its creation.  I am a well known "virus-buster" in Bulgaria
  and my antivirus programs are very widely used.  Of course, virus
  designers didn't like it.  So their next creation...  causes trouble
  to my antivirus programs.

  This virus is exactly 2000 bytes long and I think that it was
  created by the author of the Eddie (Dark Avenger) virus.  The
  programming style is the same and there are even pieces of code
  which are the same.

  The virus acts much like the Eddie one --- it installs resident in
  memory by manipulating the memory control blocks; infects
  COMMAND.COM at the first run; infects both .COM- and .EXE-files;
  infects files when one executes them as well as when one copies
  them.

   However, there are some extras added.  First, the virus is able to
   fetch the original INT 13h vector just like the V512 one (by using
   the same undocumented function --- tricks spread fast between virus
   programmers).

   Second, it intercepts the find-first (FCB) and find-next (FCB)
   functions --- just like V651 (aka EDDIE II) (and contains the same
   bugs), so you won't see the increased file lengths in the listing
   displayed by the DIR command.

   Third, it contains the string "Copyright (C) 1989 by Vesselin
   Bontchev", so people may think that I am the author of this virus.
   In fact, the virus searches every program being executed for this
   string (the case of the letters does not matter) and if found,
   hangs the system.  It is not necessary to tell you that all my
   antivirus programs contain this string.  Of course, now I will have
   to use some kind of encryption, just to prevent such tricks.


       ========================== more ============================

  Vesselin Bontchev reported in May 1990:

  The V2000 virus (DARK AVENGER 2000)
  ===================================

  - It turned out that the example of this virus I sent to some of the
  antivirus researchers was not the original version.  The original
  contains the string "Only the Good die young..."  instead of the
  "Copy me - I want to travel" message.  Also a small piece of code in
  the original version was patched to contain the "666" string.  (That
  is, the version you have contains this string, the original does
  not.)

  - There exists also a small mutation of the version you have.  The
  only difference is that the `C' character in the word "Copy" was
  changed to `Z'.

  - When describing the V2000 virus, I stated that it halts the
  computer if you run a program which contains the string "Copyright
  (c) 1989 by Vesselin Bontchev". This is not quite correct.  In fact,
  the programs are only checked for the "Vesselin Bontchev" part of
  the string.

  - I obtained John McAfee's program Clean, version 60.  In the
  accompanying documentation he states about the V2000 virus that "The
  virus is very virulent and has caused system crashes and lost data,
  as well as causing some systems to become non-bootable after
  infection".  This is not very correct, or at least, there is much
  more to be said.  The virus is exactly as virulent as the Dark
  Avenger virus, and for the same reason.  It infects files not only
  when one executes them, but also when one reads or copies them.
  This is achieved exactly in the same manner as in the Dark Avenger.
  The systems become non-bootable when the virus infects the two
  hidden files of the operating system - it cannot distinguish them
  from the regular .COM files.  By the way, the Dark Avenger virus
  often causes the same effect.  And at last, but not least (:-)), the
  virus is highly destructive - just as the Dark Avenger is.  It
  destroys the information on a randomly selected sector on the disk
  once in every 16 runs of an infected program.  The random function
  is exactly the same, and the counters (0 to 15 and for the last
  attacked sector) are exactly the same and on the same offsets in the
  boot sector as with the Dark Avenger virus.  The main difference is
  that the destroyed sector is overwritten not with a part of the
  virus body, but with the boot sector instead.  This makes a bit more
  difficult to discover which files are destroyed - the boot sector is
  contained in many "good" programs, such as FORMAT, SYS, NDD.  Also,
  the nastiest thing - the damage function is not performed via INT
  26h (which can be intercepted).  The virus determines the address of
  the device driver for the respective disk unit (using an
  undocumented DOS function call, of course.  I begin to wonder if
  Ralf Brown did any good when he made the information in the INTERxyy
  file available :-)).  Then it performs a direct call to that
  address.  The device driver in DOS does its work and issues the
  appropriate INT 13h.  However the virus has scanned the controllers'
  ROM space and has determined the original address of the interrupt
  handler - just as the Dark Avenger virus does.  Then it has
  temporary replaced the INT 13h vector with the address of this
  handler.  The result is that the damage function cannot be
  intercepted.

  - Also this virus (unlike Dark Avenger) supports PC-DOS version 4.0
  and will work (and infect) under it.

  - The bytes 84 A8 A0 AD A0 20 8F 2E in the virus body are the name
  "Diana P.", this time written in cyrillics.


        ========================== more ========================


=== Computer Virus Catalog 1.2: Dark Avenger 3 Virus (14-Feb-1991) ===
Entry...............: Dark Avenger 3 Virus
Alias(es)...........: V2000 = Eddie 3 Virus
Virus Strain........: Dark Avenger Strain
Classification......: Program Virus, RAM-resident
Length of Virus.....: 2000 Bytes (2076 Bytes in RAM resident mode)
--------------------- Preconditions ----------------------------------
Operating System(s).: MSDOS, PCDOS
Version/Release.....: 3.3
Computer model(s)...: IBM compatibles PCs
--------------------- Attributes -------------------------------------
Easy Identification.: Two Strings : 1) "Copy me - I want to travel"
                                       (at beginning of virus-code)
                                    2) "(c) 1989 by Vesselin Bontchev"
                                       (near end of virus code; but
                                        V.Bontchev is not the author!)
Type of infection...: Link-Virus (postfix infection); virus infects
                         every "COM" and "EXE" file with minimum
                         file-length of 1959 bytes.
Infection Trigger...: Programs are infected at load time (using MsDos
                         function Load/Execute) as well as on every
                         read attempt (viewing, copy etc.)
Storage media affected: Any Drive
Interrupts hooked...:   INT 21h [Dos-Functions]  ) hooked by resident
                        INT 27h [TSR]            )       part of virus
                        INT 24h [Critical Error]   > during infection
                        INT 13h [BIOS-Disk Access] > during infection
                                                         and damage
Damage..............: On every 16's execution of an infected file,
                         virus will overwrite a new random data sector
                         on disk; the last overwritten sector will be
                         stored in boot sector.
                      System hang-up, if a program is to be executed,
                         which contains the string "(c) 1989 by
                         Vesselin Bontchev"; V.Bonchev is a Bulgarian
                         author of anti-virus programs.
Damage Trigger......: The virus uses the last byte of "MSDOS-Version"-
                         field in the bootblock as counter; if an
                         infected file is executed, this counter will
                         be invremented.
Particularities.....: On some 386 PCs with different BIOS version,
                         infected programs hang-up the system during
                         virus installation.
                      The virus overwrites the transient part of DOS
                         in RAM to provoke the reload of
                         "command.com", to get a chance for an early
                         infection of this file.
                      The virus intercepts the "Find first" and
                         "Find next" functions, and on "DIR" command
                         execution, virus decreases the file length
                         of marked files by 2000 (virus length).
Similarities........: As in Eddie 2 virus, infected files are marked
                         with "62" in the "seconds"-field of time
                         stamp.
--------------------- Agents -----------------------------------------
Countermeasures.....: The virus will be (for example) detected by :
                         F-FCHK   1.13 (F. Skulason)
                         Findviru 1.8  (Solomon: Virus Tools 4.25)
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Jrg Steindecker
Documentation by....: Jrg Steindecker
Date................: 14-February-1991
===================== End of Dark Avenger 3 Virus ====================


  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++