OROPAX Virus

 


             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************

 

 

==== Computer Virus Catalog 1.2: OROPAX-Virus (July 15, 1989) =======


Entry...............: OROPAX Virus

Alias(es)...........: Music Virus

Virus Strain........: ---

Virus detected when.: February 1989

Classification......: Program Virus (extending), Direct Action,

                      RAM-resident

Length of Virus.....: COM-files: length increased by 2756-2806 Byte,

                                 always divisable by 51.


-------------------- Preconditions ----------------------------------


Operating System(s).: MS-DOS

Version/Release.....: 2.xx upward

Computer model(s)...: IBM-PC, XT, AT and compatibles


-------------------- Attributes ------------------------------------


Easy Identification.: Typical texts in Virus body (readable with

                      HexDump facilities):  "????????COM" and

                      "COMMAND.COM"


Type of infection...: System: RAM-resident, infected if function 33E0h

                         of interrupt 21h returns 33E0h in

                         AX-register.  .COM File:  extending by using

                         FindFirst/FindNext- function in the home

                         directory until a COM File is encountered

                         with a different Attribute than N or A.

                         Files are only infected once.


                         The following .COM-files will not be

                         infected:


                         - COMMAND.COM,

                         - COM files with length divisible by 51,

                         - COM file with an attribute other than N or

                           A,

                         - COM files longer than 61980 Bytes.


                         .EXE File:  no infection.


Infection Trigger...: When any of the following INT 21h functions:

                         39h, 3Ah, 3Ch, 3D01h, 41h, 43h, 46h, 13h,

                         16h, or 17h are called; these functions are

                         also used by other resident DOS commands,

                         e.g.  MD, RD, DEL, REN, and COPY.


Interrupts hooked...: INT08h, INT20h, INT21h, INT27h


Damage..............: Transient Damage: After 5 minutes, the virus

                         will start to play three melodies repeatly

                         with a 7 minute interval in between.  This

                         can only be stopped with a reset.  OROPAX and

                         earcaps can be used to avoid "music

                         overload".


Damage Trigger......: Using a random number generator, the virus

                         decides whether to become active.


--------------------- Agents ---------------------------------------


Countermeasures.....: Category 3: ANTIORO.EXE (VTC Hamburg)


Countermeasures successful: ANTIORO.EXE finds and restores infected

                      programs (only for OROPAX).


Standard means......: notice .COM file length


-------------------- Acknowledgement --------------------------------


Location............: Virus Test Center, University Hamburg, FRG

Classification by...: Thomas Lippke

Documentation/Translation: Morton Swimmer

Date................: July 15, 1989


==================== End of OROPAX-Virus ===========================


  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Comments

Post a Comment

Popular posts from this blog

PHILEMON

PHILEMON 1:1 Paul, a prisoner of Jesus Christ, and Timothy {our} brother, unto Philemon our dearly beloved, and fellowlabourer, PHILEMON 1:2 And to {our} beloved Apphia, and Archippus our fellowsoldier, and to the church in thy house: PHILEMON 1:3 Grace to you, and peace, from God our Father and the Lord Jesus Christ. PHILEMON 1:4 I thank my God, making mention of thee always in my prayers, PHILEMON 1:5 Hearing of thy love and faith, which thou hast toward the Lord Jesus, and toward all saints; PHILEMON 1:6 That the communication of thy faith may become effectual by the acknowledging of every good thing which is in you in Christ Jesus. PHILEMON 1:7 For we have great joy and consolation in thy love, because the bowels of the saints are refreshed by thee, brother. PHILEMON 1:8 Wherefore, though I might be much bold in Christ to enjoin thee that which is convenient, PHILEMON 1:9 Yet for love's sake I rather beseech {thee}, being such an one as Paul the aged, and now ...
Read more

War of the World TV series

EDITOR'S NOTE: I have only compiled this list.  I claim no responsibility for errors, discrepensies, bogus entries, repeated or contradictiory entries, spelling or grammatical errors, or governmental action against those in possession of this list. Thank for for your support! THE PREMISE: Last year, I attended a Science Fiction convention during which I discovered (along with other things) that the makers of the recently-demised TV series War of the Worlds, had a scene in the very first episode, where the original Martian war machines were found mouldering in a LA warehouse.  For fun, the special effects folk labeled one of the boxes in the warehouse 'Ark of the Covenant', indicating that it was the SAME warehouse where the Govt.  hid everything that folks were not to know about.  Recently, I decided to try to use this warehouse in a role-playing game, for fun.  I've been trying to figure out things that should be in some of the boxes.  I'...
Read more