EVIL EMPIRE virus

 

             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************

  STONED variant: EVIL EMPIRE (2 strains)

  ---------------------------------------

  Padgett Peterson reports (April 1991):

  First reported as a STONED variant examination has produced a

  considerable number of variations from the traditional STONED.

  This alert is a result of a disassembly performed on the boot sector

  of an infected floppy. Since the sector containing the display

  message was not included this text is not available, however

  examination indicates that this second sector (trk 0 hd 1 sector 3

  on floppy) contains only text.

  Virus Name:  EMPIRE

  V Status:    New

  Discovery:   April, 1991

  Symptoms:    Memory reduction, possible floppy failures, Messages

  Origin:      Alberta Canada (?)

  Eff. Length: N/A

  Type Code:   BPRtS (Boot and Partition table infector - Resident TOM

              - Stealth)

  Detection:  CHKDSK, F-DISKINF, DISKSECURE

             (SCAN v76C does not pick this up)

  Removal:     Cold boot from clean, write-protected floppy, replace

               MBR (FD) or Boot Record (Floppy) see text.

  General Comments: On first look, the virus appears similar to the

               STONED but There are notable differences:  a "cute" at

               the start will throw a researcher off if a standard

               STONED opening is expected. The virus consists of two

               sectors - the first which replaces the MBR on a fixed

               disk and the BR on a floppy, contains the executable

               code. The second sector contains the display message- I

               have not seen this as yet but it is said to refer to

               the USA as the "evil empire" and makes reference to the

               war with Iraq. This sector has a trivial encryption

               scheme to defeat text examination.

        When active in a PC, total memory will be reduced by 2048

        bytes (CHKDSK will return 653312 "total bytes memory" on a

        640k machine)

       A "stealth" mechanism is employed by the virus so that an

       examination of the MBR will fail when the virus is active in

       memory since any request for the MBR will be intercepted by the

       virus and the real MBR will be returned.  Similarly, any

       attempt to write to the MBR will be changed to a reset by the

       virus.

       No message is displayed at boot-up, rather display is a

       function of a trigger based on the real time clock during

       operation.

       On a floppy disk the original boot record is stored on track 0

       head 1 sector 2 and the message is stored on the next sector.

       High density floppies may exhibit failures as a result of this.

       Low density floppies with over 80 directory entries may also

       have problems. These can occur even long after the floppy is

       disinfected if the directory is not restored.

       The original MBR on a fixed disk is stored on cyl 0 head 0

       sector 6 with the message on the next sector.  Normally, this

       should be in the "hidden sector" area but a disk without

       "hidden sectors" will probably experience FAT failures.

       Signature scanning should reveal the virus when booted from a

       clean floppy disk using the string "A3 08 7C A1 13 04 48".

   Message (encrypted) reads:

   "I'm becoming a little confused as to where the "evil empire" is

   these days.

   If we paid attention, if we cared, we would realize just how

   unethical this impending war with Iraq is, and how impure the

   American motives are for wanting to force it.

   It is ironic that when Iran held American hostages, for a few lives

   the Americans were willing to drag negotiation on for months; yet

   when oil is held hostage, they are willing to sacrifice hundreds of

   thousands of lives, and refuse to negotiate ......"

   It is believed to be a modified version of a quote by Ron Kovick, a

   spokesman for Vietnam veterans.

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++