"8-Tunes" Virus

 

             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************

 

===== Computer Virus Catalog 1.2: "8-TUNES" Virus (11-JUN-1990) =====

Entry...............: "8-Tunes" Virus

Alias(es)...........: "1971" Virus

Virus Strain........: ---

Virus detected when.: ---

              where.: ---

Classification......: Link-virus (extending), RAM-resident

Length of Virus.....: .COM files: program length increases by

                          1971-1986 bytes: (length -3) mod 16 = 0.

                      .EXE files: program length increases by

                          1971-1986 bytes: (length -3) mod 16 = 0.

------------------- Preconditions -----------------------------------

Operating System(s).: MS-DOS

Version/Release.....: 2.xx upward

Computer model(s)...: IBM-PC, XT, AT and compatibles

------------------- Attributes --------------------------------------

Easy Identification.: Typical texts in Virus body (readable

                         with HexDump-facilities):"COMMAND.COM" in the

                         data area of the virus; increased filelength

                         if the file is infected.

Type of infection...: System: infected if function E00Fh of INT 21h

                         returns the value 4C31h in the AX-register.

                      .Com files: program length increases by

                         1971-1986 bytes; if infected, the bytes

                         007h,01fh,05fh,

                         05eh,05ah,059h,05bh,058h,02eh,0ffh,02eh,00bh,

                         000h are found 62 bytes before end of file; a

                         .COM file will only be infected once.  .COM

                         files will not be infected if filelength<8177

                         and filelength>63296; virus will be linked to

                         the end of the program.

                      .EXE files: program length increases by

                         1971-1987 bytes.  If it is infected the bytes

                         007h, 01fh, 05fh, 05eh, 05ah, 059h, 05bh,

                         058h, 02eh, 0ffh, 02eh, 00bh, 000h are found

                         62 bytes before end of file; an .EXE file

                         will only be infected once; .EXE files will

                         not be infected if filelength<8177; virus

                         will be linked to the end of the program.

Infection Trigger...: Programs are infected during load procedure

                         (Load/Execute-function of Ms-Dos).

Interrupts hooked...: INT21h, INT08h (only if triggered),

                      INT24h (only while infecting a file)

Damage..............: Transient Damage:

                      After 30 minutes, the virus will play one of

                      eigth melodies (random selection). After a short

                      time, the virus will play a melody again.

Damage Trigger......: Damage occurs 90 days after the file infection.

Particularities.....: 1. COMMAND.COM will not be infected.

                      2. Normally, the virus will stay resident at the

                            end of the available memory; only if the

                            memory is fragmented by special software,

                            the virus may become resident (via Dos-

                            function 31h).

                      3. One function (0E00Fh) used by Novell- Netware

                            4.0 can't be accessed anymore.

                      4. The damage occurs immediately when processing

                            a file with creation date before 1984.

                      5. During a file infection, the virus looks for

                            "BOMBSQAD.COM", an antivirus-tool control-

                            ling accesses to disks; if found, the

                            virus will deactivate it (tested with

                            BOMBSQAD V. 1.2).

                      6. During a file infection, the virus looks for

                            "FSP.COM" (Flushot+), an antivirus tool

                            controlling accesses to disks, files etc.

                            If found, the virus will stop file

                            infection (tested with FLUSHOT V. 1.4).

-------------------- Acknowledgement ---------------------------------

Location............: Virus Test Center, University Hamburg, FRG

Classification by...: Thomas Lippke, Michael Reinschmiedt

Documentation by....: Michael Reinschmiedt, Thomas Lippke

Date................: 11-JUN-1990

==================== End of "8-TUNES"-Virus ==========================

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++