ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/PCV4RPT.ZIP/FAUST.RPT

Text File | 1991-05-28 | 10.4 KB | 195 lines

             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************


  Report from Jim Bates - The Virus Information Service - 19th January
  1991

  === FAUST Virus (aka SPYER & CHAOS) ===

  This virus was reported by a user as at large in the UK during
  January 1991.  It apparently arrived attached to software imported
  from Hong Kong although there is a very slight possibility that
  infection occurred after importation.

  FAUST is a resident, parasitic virus which appends to executable
  files but does not infect COMMAND.COM.  The infection process may
  possibly affect other file types if they are subject to the DOS LOAD
  & EXECUTE function request.  There are two trigger routines, both of
  which are date activated on the 13th of any month, as well as a
  signature change during and after 25th December (any year).

  The primary trigger routine writes random garbage to a random
  position on the disk and this virus must therefore be classified as
  requiring immediate and total disinfection of any infected system if
  there is a risk that the primary trigger has been executed.


  OPERATION

  There are two distinct entry points to this virus, depending upon
  whether the host file is a COM or EXE type.  The both entry points
  begin by issuing an "are you there?"  call to DOS by placing a value
  of 0E7H into the AH register and requesting an INT 21H.  If the
  virus is resident, the interrupt request will return with a value of
  7Bh in the AH register.  In this case, with COM files the original
  three bytes at the beginning of the program are repaired and program
  execution is returned to the start of the host program.  With EXE
  files an immediate jump is implemented to the CS:IP setting
  contained within the original program header.  If the virus is not
  resident, the processing at both entry points will relocate the
  virus code to offset zero of the code segment and then jump to the
  virus code proper.

  Once into the virus code proper, processing continues as follows for
  both types of infection:-

  A new stack is set up and a call is made to function 4AH of the DOS
  INT 21H to allocate around 1700 bytes of memory.  No check is made
  to see if the memory was allocated successfully.  A call is then
  made to obtain the system date and this is tested to see if a) it is
  earlier than 25th December, or b) it is the 13th of the month.  If
  the date is 25th December or later, a signature used by the virus to
  recognise it's own presence within a file is modified.  This
  modification occurs each time the virus is installed and will result
  in multiple infections of target files.  Once January is reached and
  files have been infected with the latest signature version, they
  will not be re-infected until the process is repeated at the next
  25th December.  No other changes are made to the virus code and it
  is not known why this particular process has been incorporated.  The
  recognition string reported below will identify all versions of the
  virus code since it does not include this signature.  If the date is
  the 13th of the month, the virus installs three separate interrupt
  handlers - for INT 09h (Keyboard services), INT 13H (Disk I/O
  services) and INT 21H (DOS Functions).  A temporary INT 24H
  (Critical Error) handler is also used within the INT 21H handler.
  If the date is NOT the 13th of the month, the INT 09H and INT 13H
  are NOT installed.  Since these are concerned with the trigger
  routines this means that damage or interruption will not occur but
  file infection (via the INT 21H interception routines) will still
  take place.  The operation of each interrupt handler is as follows
  :-

  INT 09H  (installed 13th only) This is a simple interception routine
  which increments a counter within the virus code at every keystroke,
  and then tests its value.  When the counter reaches 100 the video
  mode is set to 80 * 25 text (mode 2) and a short message is
  collected, decrypted and displayed before processing enters an
  infinite loop and the machine "hangs".  The message is, "Chaos!!!
  Another Masterpiece of Faust...".  This is where the identifying
  name of "FAUST" has been extracted from.

  INT 13H (installed 13th only) This handler invokes the primary
  trigger routine at every fifth disk access (ANY call to INT 13H)
  request.  The counting process starts by incrementing a counter and
  testing for a value of 5.  If the test fails processing continues
  unmolested, otherwise the trigger routine is executed.  Counting
  does NOT start at zero but will vary according to the current month
  value recorded (and encoded) from the initial system date request.
  Thus for the months of January through to July (inclusive) and
  December, the initial count will start above 5 and will allow
  between 247 and 256 disk accesses before triggering.  During August
  to November (inclusive) only 2 to 5 accesses are counted before
  triggering.  The trigger routine itself holds the original INT 13H
  request and issues a Write instruction having first generated a
  random track/sector address.  The instruction is to write 9 sectors
  taken from the caller's buffer area and the write process is always
  to head zero.  No change is made to the drive specifier provided by
  the calling routine and this means that all local disks (fixed and
  floppy) are at risk.

  INT 21H (installed every time) This handler provides the infection
  routines and also the response to the "are you there?"  call issued
  during initial execution.  Apart from this function, the only other
  function intercepted is 4B00h (LOAD & EXECUTE).  When this request
  is received, the virus first verifies that the amount of free space
  on the disk will allow the addition of virus code.  Then the
  extension portion of the target filename is checked in an unusual
  way:  counting back from the end of the filename, if the second
  letter is the same as the tenth letter (as in COMMAND.COM where the
  O's match) then infection is aborted.  Then the file attributes are
  collected, stored and reset to allow write permission.  Next, the
  first and last letters of the three letter extension are checked
  against each other.  If they are the same then the virus sets a flag
  to indicate an EXE type file.  This method obviously causes problems
  if a SYS file is processed with this function.  Target files are
  checked for previous infection by examining the word at offset 41
  decimal from the end of the file.  It is this word value which is
  incremented by four at every installation during and after 25th
  December.  Thus the infection check will fail and files will gain
  multiple infections.  In our sample, the value of this word was
  1234H which may indicate that this version had NOT "mutated" in this
  way.

  The infection method is the (by now) fairly standard process of
  appending virus code to the file and modifying the initial program
  bytes (or header for EXE type files) to route processing through the
  virus code.  The only major difference with this virus is that when
  an EXE type file is first loaded, the virus is installed and before
  being made resident (using DOS Function 31H), the original file is
  loaded and executed using the DOS 4B00H function.  For EXE files
  which require large amounts of memory, this will result in Out of
  Memory errors at first execution.

  The general coding of this virus is extremely primitive and seems to
  have been written by a newcomer to assembler programming.  The usual
  infantile message persuades me to advise the programmer NOT to give
  up his day job (presumably he is employed as a deranged vagrant).
  Despite the Hong Kong connection reported above, the use of the word
  "Chaos" in the message may indicate a connection with that odious
  group known to propagate virus code from Germany and other places in
  Europe.  Alternatively, it could simply be an attempt at plagiarism.
  Interrupt handlers are installed using DOS functions 35H and 25H and
  the whole code is made TSR with function 31H.  No encryption (apart
  from the message) is used and the code is easy to detect and defend
  against.  However, the nature of the primary trigger routine is such
  as to make vigilance necessary since, like the Nomenklatura virus,
  the very presence of the virus code may indicate corrupted data
  which can not be quantified or repaired.

  Virus Information
  The virus is called FAUST, it is a resident virus which infects
  executable files via intercepted Load & Execute function calls.
  Infective length is 1184 bytes and a reliable recognition string is
  as follows :-

         B87A 0050 06B8 FD00 5026 C706 FD00 F3A4

  this will be found at offset 44H (68 decimal) from the start of the
  virus code.  I do not normally recommend disinfection of parasitic
  viruses, but if valuable code becomes infected, and no backups are
  available, COM files can be repaired by replacing the first three
  bytes of the file with the second three bytes within the virus code
  (offsets 3, 4 and 5).  EXE type files are repairable since the virus
  does not destructively overwrite any program code.  However, the
  disinfection process is somewhat involved and not recommended
  without accurate reference to a full disassembly of the virus code.

  VIS Classification - CEARXD1184A

  The information contained in this report is the direct result of
  disassembling and analysing a specimen of the virus code.  I take
  great pains to ensure the accuracy of these analyses but I cannot
  accept responsibility for any loss or damage suffered as a result of
  any errors or omissions.  If any errors of fact are noted, please
  let me know at :-

    The Virus Information Service,
    Treble Clef House,
    64, Welford Road,
    WIGSTON MAGNA,
    Leicester  LE8 1SL

  or call [phone]

  Jim Bates

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++