BRAIN virus

 

             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************

  BRAIN and variants including CHAOS.

  BRAIN was first reported in 1987 but a copyright notice (sic)

  suggests that it was published in 1986.  Despite the copyright

  notice and, consistent with normal software practice, other hands

  have since tinkered with the code and several versions with fairly

  minor modifications, mainly in the embedded text, have been

  reported.

  In its original form, it only infected 5.25" - 360 KB diskettes.

  CHAOS is a variant that infects Hard Disks.

  DAMAGE is minimal in its original version:

       a) it overwrites the original Boot Sector on the diskette (the

       first 512 bytes) and places some of its own code in this

       location from where it can intercept all calls to boot.  It

       also leaves room on the diskette for the system files.

       b) it creates 3 bad clusters (6 sectors = 3 KB) in the File

       Allocation Table (FAT). It uses the first sector of these Bad

       Clusters to store the code that it has displaced from the Boot

       Sector and the other five sectors to store the remainder of its

       own code. Its total length is around 2.25 KB but it requires

       0.5 KB of work area. When loaded into memory it occupies 7 KB.

       c) With the original version, a Volume Label (c) BRAIN is

       attached to diskettes and any existing label will be

       overwritten. Another version attaches the label (c) Ashar.  The

       label only appears when more than two files are placed in the

       directory.

       d) Unconfirmed reports advise that there is a version which

       scrambles the FAT.

  BRAIN hides from Disk Sector Editors (eg Norton) by redirecting them

  to the original Boot Sector that has been relocated into a Bad

  Cluster.

        With the original version a text message is included but not

        displayed:

                '      Welcome to the Dungeon                    '

                '                 (c) 1986 Basit & Amjad (pvt) Lt'

                'd.               BRAIN COMPUTER SERVICES..730 NI'

                'ZAM BLOCK ALLAMA IQBAL TOWN                LAHOR'

                'E-PAKISTAN..PHONE :430791,443248,280530.        '

                '  Beware of this VIRUS.....Contact us for vaccin'

                'ation............... $#@%$@!! '

        ---------------------- more -----------------------

  Version 2: (aka Ashar)

   This virus consists of a boot sector and three clusters (6 sectors)

   marked as bad in the FAT.  The first of these sectors contains the

   original boot sector, and the rest contain the rest of the virus.

   It only infects 360K floppies.  It creates a label on an infected

   disk of ' (c) ashar '.  Unlike the first version, this one does not

   leave room for the system files.

             ------------------- more -----------------

=== Computer Virus Catalog 1.2: SHOE-B v9.0 (July 10, 1989) ==========

Entry.................. SHOE-B v9.0

Alias(es).............. ---

Strain................. Brain/Pakistani

Detected: when......... November 1988

          where........ Houston University

Classification......... System (Boot sector) virus

Length of Virus........ approx. 3k (not all is actually used)

---------------------- Preconditions----------------------------------

Operating System(s).... MS-DOS

Version/Release........ Should work with all versions

Computer models........ IBM-PC's and compatibles

------------------------ Attributes-----------------------------------

Easy identification.... The volume label of the infected disk will

                        read: "(c) Brain"

Type of infection...... The virus installs itself in high memory after

                        booting with an infected disk. It captures all

                        read and  write calls to the disk, checks for

                        infection and, if not yet present, infects the

                        disk. Infection occurs by flagging five blocks

                        as bad, copying itself and the original boot

                        sector into those five blocks, and replacing

                        the boot sector with its own.  The virus

                        identifies itself by checking the boot sector

                        for the word 1234h at position 0004h in the

                        boot sector.

Infection trigger...... Counter: will attempt to infect initially

                        after 31 read/write calls, subsequently after

                        every fourth call.

Media affected......... Only floppy disks; Hard disks not infected.

Interrupts hooked...... Int 13h functions 2,3 (read,write).

Damage................. Destroys five blocks (as well as the boot

                        sector) upon infection, otherwise nothing.

Damage trigger......... ---

Particularities........ The virus looks whether attempts are made to

                        read the boot sector; in this case, the virus

                        transfers the original boot sector. The virus

                        can therefore not be identified with utilities

                        such as PC-TOOLS or NORTON  UTILITIES.

                        An infected boot sector contains the following

                        typical text:

                        "Welcome to the Dungeon (c) 1986 Basit &

                        Amjads (pvt) Ltd VIRUS_SHOE RECORD v9.0

                        Dedicated to the dynamic memories of millions

                        of virus who are no longer with us today -

                        Thanks GOODNESS!! BEWARE OF THE er..VIRUS:

                        \this program is catching   program follows

                        after these messeges..... $#%$!!  ";

                        this text is never displayed.

Similarities........... Similar to all viruses of Pakistani/Brain

                        strain.

----------------------- Agents ------------------------------

Countermeasures........ ----

Countermeasures successful ---

Standard Means......... The DOS command "SYS n:" (where n is the drive

                        of the infected disk) will disinfect the disk

                        IF AND ONLY IF you have booted from a clean

                        disk.  You will have to use utilities such as

                        PC-TOOLS to recover the "bad" sectors.

--------------------- Acknowledgements--------------------------------

Location............... VTC Hamburg, FRG

Classification by...... Morton Swimmer

Documentation by....... Morton Swimmer

Date................... June 29, 1989

Information source..... PC VIRUS LISTING (Jim Goodwin)

===================== End of SHOE-B v9.0 Virus ======================

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++