Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/VIRUS/ALLVIRUS.DF

Internet Message Format | 1989-05-26 | 31KB

From mcvax!cs.hw.ac.uk![e-mail] Sun May  7 14:33:38 1989
Received: from uunet.UU.NET by atanasoff.cs.iastate.edu (3.24.1) id AA15611; Sun, 7 May 89 14:33:16 CDT
Received: from mcvax.UUCP by uunet.uu.net (5.61/1.14) with UUCP
    id AA16504; Sun, 7 May 89 15:33:04 -0400
Received: by mcvax.cwi.nl via EUnet; Sun, 7 May 89 21:22:35 +0200 (MET)
Received: from cs.hw.ac.uk by kestrel.Ukc.AC.UK   via Janet (UKC CAMEL FTP)
           id aa25450; 7 May 89 20:08 BST
Received: from surya.cs.hw.ac.uk (surya) by brahma.cs.hw.ac.uk; Sun, 7 May 89 20:05:07 BST
From: "David.J.Ferbrache" <mcvax!cs.hw.ac.uk![e-mail]>
Message-Id: <[e-mail]>
Subject: Virus list (Homebase bulletin board and others)
To: [e-mail],
        OJA <nccibm1.bitnet![e-mail]>,
        RADAI1 <hbunos.bitnet![e-mail]>,
        luken <lehiibm1.bitnet![e-mail]>,
        [e-mail], well![e-mail]
Date: Sun, 7 May 89 20:07:33 BST
Cc: rzotto <dknkurz1.bitnet![e-mail]>,
        r746ll12 <cmccvb.bitnet![e-mail]>,
        [e-mail], [e-mail],
        utoday![e-mail]
X-Mailer: ELM [version 2.2 PL0]
Status: R


Please find enclosed for your information and comment a listing of IBM PC
viruses from Jim Goodwin's Homebase BBS which Jim Wright passed on to me.
I have restructure the original document slightly to place each of his
48 viruses under the original parent virus, so that strains of Brain are
grouped together. I have also added a few comments of my own in brackets.

Can I strongly suggest we pool our resources so that one comprehensive list
can be produced. It would seem well worth contacting Jim to arrange for
details of 1. the new viruses he describes, and 2. the modifications of
well know viruses which he has observed.




PC VIRUS LISTING
by Jim Goodwin

[edited without permission by Dave Ferbrache]

     It is difficult to name, identify and classify PC viruses.
Everyone who first discovers a virus will name it and describe
what they think of it.  In most cases, the virus is not new and
has been named and described dozens of times before.  None of the
names and few of the descriptions will match.  While I'm writing
this, for example, I feel certain that someone, somewhere has
just been infected by the Jerusalem virus and they are telling
their co-workers and friends about it as if it were newborn - and
for them perhaps it is.  It will be impossible to verify the
strain and variety of the infection, however, unless we can get a
living sample of the virus to analyze and compare with other
strains of this same virus.  So problem number one is filtering
the reports of infection and collecting samples that can be
placed under the knife.

     Problem number two is - where do you draw the line between
an original virus and a true variation of the virus.  The
original Brain virus, for example, could only infect a floppy
diskette.  Do the varieties of the Brain that can infect hard
disks (but in every other respect are identical) deserve to be
called new viruses, or are they still the Brain?  What about
further modifications that destroy data?  Is this now a new
virus?  What if nothing changes but the imbedded text data, so
that the virus is in every way functionally identical, but the
volume label changes to "SMURF" instead of BRAIN.  All of these
modifications to the Brain have been discovered and logged.  How
do we deal with them?
     I choose to deal with these modifications in the simplest
way I know.  If the virus differs in any way from the original
(assuming that the "original" can in fact be identified), then I
log it as a new virus.  This relieves me from having to make
decisions.  Those of you who see the world differently can merely
take this listing and lump together all of the different strains
that you like.  That way we'll all be happy.

[have done Jim, it does seem simpler to me and allows tracing of the
    evolution of viruses. I personally think an edited text string does
    not constitute a new virus, although I agree the line is often hard to
    judge]

     This will be, by the way, my last virus document.  I have
worked double time for the past eighteen months helping John
McAfee and his Homebase folks and, while I have thouroughly
enjoyed myself, I have finally burned out.  It has been great fun
and I've learned a lot, and hopefully some of my works, like the
product review with Sankary and Marsh, will end up being somehow
useful to the world.  But now I have the irresistible urge to go
fishing, and, perhaps afterwards, to contemplate my navel for a
few years.  In-between times I intend to write a book on the
craziness in this industry and about the unique personalities
I've had the pleasure to work with in the Virus Marine Corps.
It's been quite an adventure.  Thank you all.

Jim Goodwin




                    THE VIRUSES

     I have arranged these viruses so that similar varieties are
described in the sequence in which they appeared within the virus
sub-group (to the best of my knowledge).  Not everyone agrees
with my groupings.  Many people believe, for instance, that the
Golden Gate-C (Mazatlan Virus) is a distinctly original virus and
is not a variation of the Alameda.  I think differently and have
endeavored to show how the Golden Gate evolved from the Alameda,
through each precursor virus.  I cannot prove, of course, that
the sequence of appearances is the correct sequence, and in many
cases I have had to guess.  If you anyone wishes to re-order
these virus, I will not be offended.
     I have not included any of the specific application trojans
in this list.  There has been a lot of discussion about the Lotus
123 and DBASE "viruses", for example.  These are not replicating
programs and I do not classify them as viruses.  I had originally
intended a separate list to include these non-replicating trojans
but Time caught up with me.



[BOOT SECTOR AND PARTITION RECORD VIRUSES]
[----------------------------------------]

[ALAMEDA VIRUS AND VARIANTS]

(Also called: Yale; Merritt; Pecking; Seoul)

First discovered at Merritt college in California (1987).
Original version caused no intentional damage.
replicates at boot time <ctrl>-<alt>-<del> and infects only
5 1/4" 360KB floppies.  It saves the real boot sector at track 39,
sector 8, head 0.  Contains a count of the number of times it has
infected other diskettes, although it is referenced for write only and is
not used as part of an activation algorithm.  The virus
remains resident at all times after it is booted, even if no
floppy is booted and BASIC is loaded.  Contains a rare POP
CS instruction that makes it incapable of infecting 286
systems.

     ALAMEDA-B (Also called Sacramento Virus)

     This is the original Alameda Virus that has the POP CS
     removed.  Relocation is accomplished through a long jump
     instruction.  All other characteristics are identical.  This
     version runs OK on a 286.

     ALAMEDA-C

     This is the Alameda-B virus that has been modified to
     disable the boot function after 100 infections.  The
     counter in the original Alameda virus has been re-activated
     and is interrogated at each bootup.  When it reaches 100 the
     virus disconnects from the original boot sector (control is
     no longer passed) and the diskette will no longer boot.  At
     infection time, the counter is zeroed on the host diskette.

     SF VIRUS

     This is the Alameda-C that has been modified to format the
     boot diskette when the counter runs out.

     GOLDEN GATE VIRUS (Also called The 500 Virus)

     This is the SF Virus that has been modified to format the C
     drive when the counter runs out.  The activation occurs
     after 500 infections, instead of 100 infections.  Note that
     in all three of these strains, the counter is zeroed on the
     host diske