ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/PCV4RPT.ZIP/VIRDEM.RPT

Text File | 1991-05-28 | 7.4 KB | 149 lines

             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************


  Report from Jim Bates - The Virus Information Service - June 1990

  === Virdem Virus ===


  The book by Ralf Burger has already been reviewed (VB Oct 89) and
  the incredible irresponsibility and arrogance of the author in
  publishing virus source code has been noted both here and elsewhere.
  Burger's suggestion (in 1986) that viruses - "used properly may
  bring about a new generation of self-modifying computer operating
  systems" has still not been realised and subsequent events have
  shown his book to be one of the current sources of reference for the
  inadequate and immature people who write viruses.  Another area
  where Burger has provided the virus writers with working material to
  further their craft is with so-called "demonstration" viruses.
  These not only mean that more recognition "signatures" need to be
  published, but they will also produce "families" of similar strains
  (like the Vienna group) which makes the whole process of fighting
  the threat much more complex than it needs to be.  It is well past
  time that international legislation was formulated to make such
  activity a criminal offence.  The most well known of Burger's demos
  is his VIRDEM virus, mentioned in the book.  Fortunately, this is
  poorly written and contains bugs so that acolytes will need to
  disassemble AND debug these programs before they can advance their
  own modifications.  However, this will undoubtedly be done and new
  viruses can be expected to use some of the techniques used in VIRDEM
  and other "demo" virus code.  For this reason, a brief description
  of VIRDEM may be useful to anti-virus researchers.

  VIRDEM uses a "generation" number for each successive infection up
  to a maximum of 9.  This is very simply done by incrementing a
  counter within the infection cycle and checking that it once it
  reaches nine, the counter is disabled.  This is used to collect
  indexed access to a table of entries which are, in turn, used as a
  basis for a guessing game when infected programs are executed.  What
  happens is that the generation number is used as the upper limit of
  an integer to be guessed.  An pseudo-random integer is generated by
  accessing and gating the system clock and if the operator's guess
  matches it then program operatio is allowed.  Otherwise the program
  does not run and an appropriate message is displayed (I disassembled
  the original Version 1.06 with German text).

  Burger's own comments on this are worth repeating to indicate the
  weak reasoning and woolly thinking that this man indulges in :-

  "Unfortunately the source code cannot be published because with the
  help of the source code anyone would be able to change the
  manipulation task and have a non-overwriting virus in 8088 machine
  language.  In addition it would be almost unthinkable if there were
  suddenly numerous dangerously modified versions of VIRDEM.COM
  around."

  This is either blindness or stupidity!  He obviously assumes that
  anyone buying (?) a demonstration virus will be incapable of
  disassembling it.  VIRDEM is quite easy to take apart and equally
  easy to understand (and modify) and is almost as dangerous in it's
  code form as it would be in source code.  It should also be noted
  that VIRDEM is NOT a "non- overwriting" virus, it reads the first
  1280 (500H) bytes of the target program file, and appends them to
  the end of the file.  It then overwrites these initial 1280 bytes
  with the virus code.  Finally, a small stub recovery routine is also
  appended. The virus only infects floppy disks placed into drive A:
  and rather than reporting in detail on the virus operation, I shall
  list Burger's own comments regarding it - together with my own
  findings after disassembly:

  1) All COM files up to the second subdirectory are infected.  (The
     virus is non resident and infects only one file during each
     execution)

  2) The first COM file in the root  directory (often
     COMMAND.COM) is not infected.  (This is true although no reason
     is given.  The possibility that COMMAND.COM will be the first
     file in the root directory is noted but no attempt is made in the
     code to avoid infecting it if it isn't.)

  3) COM files of more than about 1.5K in length are expanded by
     about 1.5K, shorter files are expanded by about 3K.  (Files
     longer than 1380 bytes are expanded by 1366 bytes - shorter files
     are first made 1280 bytes long and THEN expanded by 1366 bytes.
     No check is made on whether there is actually room for virus code
     and a work area within the 64K COM format limit so files greater
     than 62122 bytes are irreparably damaged.)

  4) Infected programs remain completely functional.  (As noted above,
     this is not true for large files and there are also some
     unpredictable and possibly dangerous effects when the machine
     configuration includes certain device drivers.)

  5) An infected program is recognised and cannot be infected twice.
     (True - an infected program is recognised by an initial word of
     9090H.)

  6) VIRDEM.COM inserts an additional function into the infected
     program.  This additional function is a guessing game whose
     difficulty level is dependent on the virus generation.  (True)

  7) VIRDEM mutates up to the ninth generation.  After that the
     propagation continues but no mutation takes place.  (Maybe the
     word "mutates" was an incorrect translation from the original
     German.  Certainly the virus counter is altered but not as a
     result of a "mutation", rather because of an infection counter.)

  This virus uses only DOS function calls and since it is not
  resident, it has no defence mechanisms against anti-virus search
  programs. Therefore a version with only simple modifications will
  not be difficult to detect.  More sophisticated changes will require
  separate disassembly and reporting.  The hexadecimal recognition
  string for this version is :-

         03 C3 8B F0 26 8B 1C 8B F3 BF 00 01 B9 00 05 90

  at offset 411 (19B Hex) from the start of an infected file.

  The fact that Burger was allowed to publish a "cookbook" and
  "demonstration" virus code for aspiring virus writers is an
  international scandal.  His irresponsibility is matched only by his
  publishers (DATA Becker and ABACUS).

  The information contained in this report is the direct result of
  disassembling and analysing a specimen of the virus code.  I take
  great pains to ensure the accuracy of these analyses but I cannot
  accept responsibility for any loss or damage suffered as a result of
  any errors or omissions.  If any errors of fact are noted, please
  let me know at :-

    The Virus Information Service,
    Treble Clef House,
    64, Welford Road,
    WIGSTON MAGNA,
    Leicester  LE8 1SL

  or call [phone]

  Jim Bates

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++