146 lines
4.5 KiB
Plaintext
146 lines
4.5 KiB
Plaintext
Information on the Brain Virus And Variants
|
||
Prepared by David Stang
|
||
National Computer Security Association
|
||
Suite 309, 4401-A Connecticut Avenue NW
|
||
Washington, DC 20008
|
||
(202) 364-8252 (voice)
|
||
(202) 364-1304 (BBS)
|
||
This material (c) 1989 NCSA. It may not be reproduced
|
||
without attribution to the NCSA.
|
||
|
||
Synonyms: Pakistani Brain, Basit Virus.
|
||
|
||
This virus originated in January, 1986, in Lahore
|
||
Pakistan, but the first noticeable infection problems
|
||
did not surface until 1988. In the spring of 1988, for
|
||
instance, 100 machines at The Providence Journal-Bulletin
|
||
were infected with it.
|
||
|
||
The Brain is the only virus yet discovered that
|
||
includes the valid names address and phone numbers of
|
||
the original perpetrators. It was written by two
|
||
brothers running a computer store in Lahore Pakistan.
|
||
According to some sources, Basit Farooq Alvi, one of
|
||
the brothers, wrote the virus so that it would infect
|
||
machines running bootleg copies of a program he was
|
||
selling for physicians. The original Brain put a
|
||
copyright notice in the directory of floppy disks, but
|
||
did no other damage.
|
||
|
||
The Brain is a boot sector infector, approximately 3 K
|
||
in length, that infects 5 1/4" floppies. It cannot
|
||
infect hard disks. It will infect a diskette whenever
|
||
the diskette is referenced. For example, a Directory
|
||
command, executing a program from the diskette, copying
|
||
a file from or to the diskette or any other access will
|
||
cause the infection to occur. The virus stores the
|
||
original boot sector, and six extension sectors,
|
||
containing the main body of the virus, in available
|
||
sectors which are then flagged as bad sectors.
|
||
Diskettes have 3K of bad sectors (the normal numbers
|
||
are none at all, or 5K, or sometimes more).
|
||
|
||
No known intentional damage. Unintentional damage: it
|
||
slows down diskette accesses and causes time-outs,
|
||
which can make some diskette drives unusable.
|
||
|
||
The virus is able to hide from detection by
|
||
intercepting any interrupt that might interrogate the
|
||
boot sector and re-directing the read to the original
|
||
boot sector. Thus, programs like the Norton Utilities
|
||
will be unable to see the virus.
|
||
|
||
Infected diskettes are noticeable by "@BRAIN" or "(c)
|
||
BRAIN" displayed in the volume label.
|
||
|
||
|
||
|
||
Brain-B
|
||
|
||
Synonyms: Brain-HD, the Hard Disk Brain, Houston Virus.
|
||
|
||
This virus is identical in every respect to the
|
||
original Brain, with the single exception that it can
|
||
infect the C drive.
|
||
|
||
|
||
|
||
Brain-C
|
||
|
||
This virus is the Brain-B that has the volume label
|
||
code removed. The volume label of infected diskettes
|
||
does not change with this virus. This virus was
|
||
difficult to detect since it does nothing overt in the
|
||
system.
|
||
|
||
|
||
|
||
Clone Virus
|
||
|
||
This virus is the Brain-C that saves the original boot
|
||
copyright label and restores it to the infected boot.
|
||
The Basit & [A]mjad original Brain messages have been
|
||
replaced with non-printable garbage that looks like
|
||
instructions if viewed through Norton or other utility.
|
||
Even if the system is booted from a clean diskette, it
|
||
is virtually impossible to tell, by visual inspection,
|
||
whether the hard disk is infected.
|
||
|
||
|
||
|
||
Shoe_virus
|
||
|
||
Synonym: UIUC Virus.
|
||
|
||
This virus is the Brain-B virus that has been modified
|
||
to include the message - "VIRUS_SHOE RECORD, v9.0.
|
||
Dedicated to the dynamic memories of millions of virus
|
||
who are no longer with us today". The message is never
|
||
displayed.
|
||
|
||
This might be identified with the Ashar vrus, as there
|
||
is a VIRUS_SHOES RECORD v9.0 with the identifying
|
||
string "ashar" at offset 04a6hex.
|
||
|
||
|
||
|
||
Shoe_virus-B
|
||
|
||
Experts disagree on the classification of this.
|
||
|
||
@BULLET = It may be the Shoe_Virus that has been
|
||
modified to so that it can no longer infect hard disks.
|
||
The v9.0 has been changed to v9.1.
|
||
|
||
@BULLET = There is a version of Brain with VIRUS_SHOE
|
||
RECORD v9.0 which is incapable of activating a virus
|
||
stored on hard disk due to the drive number being
|
||
hardwired into the read routine for loading the virus.
|
||
v9.1 may be the hard disk variant of Brain.
|
||
|
||
|
||
|
||
Clone-B
|
||
|
||
This is the Clone virus that has been modified to
|
||
corrupt the FAT when it is booted after May 5, 1992.
|
||
There are no other apparent modifications.
|
||
|
||
|
||
|
||
Jork Virus
|
||
|
||
This virus is the Shoe_virus with the identifying text
|
||
at offset 0010hex reduced to "Welcome to the Dungeon
|
||
(c) 1986 Brain", with the text at 0202hex reading "(c)
|
||
1986 Jork & Amjads (pvt) Ltd".
|
||
|
||
|
||
|
||
Terse Shoe Virus
|
||
|
||
This is a variant of the Shoe-virus with the initial
|
||
text message truncated to a single line.
|
||
|
||
end of text. Prepared 12/7/89
|
||
|