146 lines
4.5 KiB
Plaintext
146 lines
4.5 KiB
Plaintext
|
Information on the Brain Virus And Variants
|
|||
|
|
Prepared by David Stang
|
|||
|
|
National Computer Security Association
|
|||
|
|
Suite 309, 4401-A Connecticut Avenue NW
|
|||
|
|
Washington, DC 20008
|
|||
|
|
(202) 364-8252 (voice)
|
|||
|
|
(202) 364-1304 (BBS)
|
|||
|
|
This material (c) 1989 NCSA. It may not be reproduced
|
|||
|
|
without attribution to the NCSA.
|
|||
|
|
|
|||
|
|
Synonyms: Pakistani Brain, Basit Virus.
|
|||
|
|
|
|||
|
|
This virus originated in January, 1986, in Lahore
|
|||
|
|
Pakistan, but the first noticeable infection problems
|
|||
|
|
did not surface until 1988. In the spring of 1988, for
|
|||
|
|
instance, 100 machines at The Providence Journal-Bulletin
|
|||
|
|
were infected with it.
|
|||
|
|
|
|||
|
|
The Brain is the only virus yet discovered that
|
|||
|
|
includes the valid names address and phone numbers of
|
|||
|
|
the original perpetrators. It was written by two
|
|||
|
|
brothers running a computer store in Lahore Pakistan.
|
|||
|
|
According to some sources, Basit Farooq Alvi, one of
|
|||
|
|
the brothers, wrote the virus so that it would infect
|
|||
|
|
machines running bootleg copies of a program he was
|
|||
|
|
selling for physicians. The original Brain put a
|
|||
|
|
copyright notice in the directory of floppy disks, but
|
|||
|
|
did no other damage.
|
|||
|
|
|
|||
|
|
The Brain is a boot sector infector, approximately 3 K
|
|||
|
|
in length, that infects 5 1/4" floppies. It cannot
|
|||
|
|
infect hard disks. It will infect a diskette whenever
|
|||
|
|
the diskette is referenced. For example, a Directory
|
|||
|
|
command, executing a program from the diskette, copying
|
|||
|
|
a file from or to the diskette or any other access will
|
|||
|
|
cause the infection to occur. The virus stores the
|
|||
|
|
original boot sector, and six extension sectors,
|
|||
|
|
containing the main body of the virus, in available
|
|||
|
|
sectors which are then flagged as bad sectors.
|
|||
|
|
Diskettes have 3K of bad sectors (the normal numbers
|
|||
|
|
are none at all, or 5K, or sometimes more).
|
|||
|
|
|
|||
|
|
No known intentional damage. Unintentional damage: it
|
|||
|
|
slows down diskette accesses and causes time-outs,
|
|||
|
|
which can make some diskette drives unusable.
|
|||
|
|
|
|||
|
|
The virus is able to hide from detection by
|
|||
|
|
intercepting any interrupt that might interrogate the
|
|||
|
|
boot sector and re-directing the read to the original
|
|||
|
|
boot sector. Thus, programs like the Norton Utilities
|
|||
|
|
will be unable to see the virus.
|
|||
|
|
|
|||
|
|
Infected diskettes are noticeable by "@BRAIN" or "(c)
|
|||
|
|
BRAIN" displayed in the volume label.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Brain-B
|
|||
|
|
|
|||
|
|
Synonyms: Brain-HD, the Hard Disk Brain, Houston Virus.
|
|||
|
|
|
|||
|
|
This virus is identical in every respect to the
|
|||
|
|
original Brain, with the single exception that it can
|
|||
|
|
infect the C drive.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Brain-C
|
|||
|
|
|
|||
|
|
This virus is the Brain-B that has the volume label
|
|||
|
|
code removed. The volume label of infected diskettes
|
|||
|
|
does not change with this virus. This virus was
|
|||
|
|
difficult to detect since it does nothing overt in the
|
|||
|
|
system.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Clone Virus
|
|||
|
|
|
|||
|
|
This virus is the Brain-C that saves the original boot
|
|||
|
|
copyright label and restores it to the infected boot.
|
|||
|
|
The Basit & [A]mjad original Brain messages have been
|
|||
|
|
replaced with non-printable garbage that looks like
|
|||
|
|
instructions if viewed through Norton or other utility.
|
|||
|
|
Even if the system is booted from a clean diskette, it
|
|||
|
|
is virtually impossible to tell, by visual inspection,
|
|||
|
|
whether the hard disk is infected.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Shoe_virus
|
|||
|
|
|
|||
|
|
Synonym: UIUC Virus.
|
|||
|
|
|
|||
|
|
This virus is the Brain-B virus that has been modified
|
|||
|
|
to include the message - "VIRUS_SHOE RECORD, v9.0.
|
|||
|
|
Dedicated to the dynamic memories of millions of virus
|
|||
|
|
who are no longer with us today". The message is never
|
|||
|
|
displayed.
|
|||
|
|
|
|||
|
|
This might be identified with the Ashar vrus, as there
|
|||
|
|
is a VIRUS_SHOES RECORD v9.0 with the identifying
|
|||
|
|
string "ashar" at offset 04a6hex.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Shoe_virus-B
|
|||
|
|
|
|||
|
|
Experts disagree on the classification of this.
|
|||
|
|
|
|||
|
|
@BULLET = It may be the Shoe_Virus that has been
|
|||
|
|
modified to so that it can no longer infect hard disks.
|
|||
|
|
The v9.0 has been changed to v9.1.
|
|||
|
|
|
|||
|
|
@BULLET = There is a version of Brain with VIRUS_SHOE
|
|||
|
|
RECORD v9.0 which is incapable of activating a virus
|
|||
|
|
stored on hard disk due to the drive number being
|
|||
|
|
hardwired into the read routine for loading the virus.
|
|||
|
|
v9.1 may be the hard disk variant of Brain.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Clone-B
|
|||
|
|
|
|||
|
|
This is the Clone virus that has been modified to
|
|||
|
|
corrupt the FAT when it is booted after May 5, 1992.
|
|||
|
|
There are no other apparent modifications.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Jork Virus
|
|||
|
|
|
|||
|
|
This virus is the Shoe_virus with the identifying text
|
|||
|
|
at offset 0010hex reduced to "Welcome to the Dungeon
|
|||
|
|
(c) 1986 Brain", with the text at 0202hex reading "(c)
|
|||
|
|
1986 Jork & Amjads (pvt) Ltd".
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Terse Shoe Virus
|
|||
|
|
|
|||
|
|
This is a variant of the Shoe-virus with the initial
|
|||
|
|
text message truncated to a single line.
|
|||
|
|
|
|||
|
|
end of text. Prepared 12/7/89
|
|||
|
|
|