Zero Bug virus

 


             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************



 

===== Computer Virus Catalog 1.2: "Zero Bug" Virus (15-Feb-1990) =====


Entry...............: "Zero Bug"

Alias(es)...........: "ZBug","Palette"

Virus Strain........:

Virus detected when.: October 1989

              where.:

Classification......: Link-Virus (extending), RAM - resident

Length of Virus.....: .COM-Files increased by 1536 bytes

                           in RAM : 1792 bytes + environment


--------------------- Preconditions ----------------------------------


Operating System(s).: MS-DOS

Version/Release.....: 2.xx upward

Computer model(s)...: IBM - PC, XT, AT and compatibles


--------------------- Attributes -------------------------------------


Easy Identification.: Typical text in Virus body (readable with

                           HexDump-utilities): "ZE","COMSPEC=C:",

                           "C:\COMMAND.COM".

                      .COM files: "seconds" field of the timestamp

                           changed to 62 sec (similar to GhostBalls

                           original Vienna viruses).


Type of infection...: System: RAM-resident, infected if string "ZE"

                           is found at offset 0103h (INT 60h).

                      .COM file: extended by using CREATE-function.

                           Adds 1536 bytes to the beginning of the

                           file; a file will not be infected more

                           than once.

                      .EXE File: no infection.


Infection Trigger...: When function 3C00h (CREATE) and 4000h (WRITE)

                           of INT 21h is called (e.g. if you use

                           "COPY *.COM <destination>", then every

                           destination-file will be infected).


Interrupts hooked...: INT 60h,  INT 21h, INT 1Ch


Damage..............: Permanent Damage:

                      1.  Every time a .COM file is created in an

                          infected system with function 3Ch of INT

                          21h, the file will be infected.


                      Transient Damage:

                      1.  If INT 1Ch is hooked, every 14 sec INT 21h

                          will be set to the viruscode (programs which

                          hooked INT 21h will be unhooked and hang).

                      2.  All characters "0" (zero) will be exchanged

                          with other characters. Exchange characters

                          are 01h, 2Ah, 5Fh, 3Ch, 5Eh, 3Eh and 30h,

                          in which case the attribute is set to back-

                          ground color (i.e. the character is invi-

                          sible). This routine uses about 10% of CPU-

                          time (system is slowed down accordingly).

                      3.  Modifies the filelength in the Disk

                          Transfer Area (DTA): files doesnot appear

                          as infected. The length of the files with

                          seconds field of timestamp set to 62 sec

                          will be modified in DTA accordingly:

                          filelength := filelength - viruslength.


Damage Trigger......: Only if "C:\COMMAND.COM" is infected, INT 1Ch is

                          hooked  and damage is done.

                      After 240 reboots of system, the first damage

                          occurs. The next damage occurs after every

                          fifth reboot.


Particularities.....: In case of MS-DOS error in 2.xx, system can hang

                          by infection of "C:\COMMAND.COM".

                      Programs longer than 63728 bytes are not

                          executed correctly after infection.


--------------------- Agents -----------------------------------------


Countermeasures.....: Category 3: ANTI_ZBG.EXE (VTC Hamburg)


- ditto - successful: ANTI_ZBG.EXE finds and restores infected

                      programs.


        unsuccessful: Programs which check only the filelength of

                      infected files in an infected system may fail.


Standard means......: Notice .COM file length.


--------------------- Acknowledgement --------------------------------


Location............: Virus Test Center, University Hamburg, FRG

Classification by...: Stefan Tode

Documentation by....: Stefan Tode

Date................: January 20, 1990


===================== End of "Zero Bug"-Virus ========================

 


  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Comments

Post a Comment

Popular posts from this blog

BOTTOM LIVE script

                                  BOTTOM                                   ======                     by Adrian Edmondson and Rik Mayall                                 Bottom Live                                 ===========                               Richie  Rik Mayall                                Eddie  Adrian Edmondson Introduction ------------ [Opening shot of theatre, with huge pictures of Richie and Eddie. Caption: "Live fro...
Read more

Evidence supporting quantum information processing in animals

              Evidence supporting quantum            information processing in animals                    James A. Donald                    1068 Fulton Av                    Sunnyvale, CA 94089-1505                    USA I show that quantum systems can rapidly solve some problems for which finite state machines require a non- polynomially large time. This class of problems is closely related to the class of problems that animals can solve rapidly and effortlessly, but are intractable for computers by all known algorithms. 1. Introduction      Animals, including very simple animals, can rapidly and effortlessly perceive objects, whereas computers take nonpolynomial time to do this by all...
Read more

ARMIES OF CHAOS

                          ARMIES OF CHAOS -      Before anyone proposes more gun control, he or she should know  about a simple, deadly weapon 4 times as powerful as Dirty Harry's  legendary .44 Magnum -- and at least twice as concealable -- that  _can't_ controlled.        This simple, deadly weapon can be made by anyone -- even a  child -- with unpowered hand tools in an hour's time using $5 worth  of materials, most of which are available around the house anyway.   In traditional form it's reusable an unlimited number of times, and  modern plastics have rendered its disposable version electronically  undetectable.  You can clear a room with such a weapon (more of a  hand-held directional grenade than a gun -- sort of a recycleable  Claymore mine) and it's just one of hundreds of similar time-proven  designs. ...
Read more