"South African Friday the 13th" virus

 


             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************


 

 

 Computer Virus Catalog 1.2: South African Friday 13.  (Sept.20,1989)


Entry...............: "South African Friday the 13th" virus

Alias(es)...........: Virus-B, Miami, Munich

Virus Strain........:

Virus detected when.: 1987

              where.: South Africa

Classification......: .COM file infecting virus/Extending/Direct

Length of Virus.....: 419 bytes


-------------------- Preconditions ---------------------------


Operating System(s).: MS-DOS

Version/Release.....: 2.0 or higher

Computer model(s)...: IBM PC,XT,AT and compatibles


------------------ Attributes ------------------------------------


Easy Identification.: Text "INFECTED" found near start of virus.


Type of infection...: Virus adds itself to end of file and places a

                      three-byte jump at the beginning.


Infection Trigger...: When an infected file is run, it will infect

                      every .COM file in the current directory, with

                      the excep- tion of COMMAND.COM.


Storage media affected:


Interrupts hooked...: ---


Damage..............: Every infected file run on a Friday the 13th

                      will be deleted.


Damage Trigger......: Current date, as reported by DOS.


Particularities.....: ----


Similarities........:  The effect is similar to that of other,

                       unrelated viruses. VIRUS-B is a modified

                       variant of this virus.


--------------------- Agents --------------------------------------


Countermeasures.....: All programs which check for .COM file length

                      changes will detect infections.

                      Simply making all .COM files read-only is

                      effective against this virus.


Countermeasures successful:

                      Detection of infection:

                           F-FCHK (from F.Skulason's F-PROT package)

                           VIRUSCAN

                      Removal:   F-FCHK


Standard means......: Write-protect every .COM file with "attrib +r

*.COM".


-------------------- Acknowledgement -------------------------------


Location............: University of Iceland/Computing Services

Classification by...: Fridrik Skulason  (frisk@rhi.hi.is)

Documentation by....: Fridrik Skulason

Date................: Sept 20, 1989

Information Source..: ---


==================== End of South-African virus ======================



  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Comments

Popular posts from this blog

BOTTOM LIVE script

Fawlty Towers script for "A Touch of Class"