76 lines
4.0 KiB
Plaintext
76 lines
4.0 KiB
Plaintext
Virus Name: Malmsey
|
||
Aliases:
|
||
V Status: Rare
|
||
Discovered: October, 1992
|
||
Symptoms: .COM files overwritten; programs fail to function properly;
|
||
file date/time changes
|
||
Origin: Canada
|
||
Eff Length: 495 Bytes
|
||
Type Code: ONCK - Overwriting Non-Resident .COM Infector
|
||
Detection Method: Novi 1.15a+, F-Prot, VNet, Viruscan V99+, VBuster,
|
||
Sweep 2.43a+, IBMAV, AVTK 6.04+, NShld V99+, Sweep/N
|
||
Removal Instructions: Delete infected files
|
||
|
||
General Comments:
|
||
The Malmsey virus was received in October, 1992, and was written
|
||
by a person using the name Lucifer Messiah. Malmsey is from
|
||
Canada. This virus is a non-resident, direct action overwriting
|
||
virus which infects .COM programs, including COMMAND.COM. A
|
||
later version of the virus, Malmsey 2 described below, is a
|
||
parasitic, non-resident, direct action .EXE infector.
|
||
|
||
When a program infected with the Malmsey virus is executed, the
|
||
Malmsey virus will infect one .COM program located in the current
|
||
directory, overwriting the first 495 bytes of the host file. The
|
||
programs date and time in the DOS disk directory listing will have
|
||
been updated to the current system date and time when infection
|
||
occurred. The following text strings can be found in all Malmsey
|
||
infected programs:
|
||
|
||
"*.COM"
|
||
"[Malmsey Habitat v. 1.3]"
|
||
"Warmest Regards to RABID"
|
||
"from -- ANARKICK SYSTEMS!"
|
||
|
||
Malmsey doesn't appear to do anything besides replicate, though
|
||
infected programs will be permanently corrupted.
|
||
|
||
Known variant(s) of Malmsey are:
|
||
Malmsey 2: A later version of the Malmsey virus, this variant
|
||
infects one .EXE program each time an infected program
|
||
is executed. Infected programs will have a file length
|
||
increase of 1,703 to 1,717 bytes with the virus being
|
||
located at the end of the file. The Malmsey 2 virus
|
||
will occassionally reinfect previously infected
|
||
programs, adding an additional 1,712 bytes with each
|
||
reinfection. The file's date and time in the DOS disk
|
||
directory listing will not be altered. The following
|
||
text strings can be found in the viral code in Malmsey 2
|
||
infected programs:
|
||
"Malmsey Habitat v. 2.0"
|
||
"Lucifer Messiah -- ANARKICK SYSTEMS 07-18-"
|
||
"Hap Birthday !"
|
||
Origin: Canada October, 1992.
|
||
Malmsey 3 Beta: A later version of the Malmsey 2 virus, this
|
||
variant is a memory resident infector of .COM and .EXE
|
||
programs, including COMMAND.COM. It becomes memory
|
||
resident at the top of system memory but below the 640K
|
||
DOS boundary, hooking interrupts 3 and 21. Total system
|
||
and available free memory, as indicated by the DOS CHKDSK
|
||
program, will have decreased by 2,048 bytes. Once memory
|
||
resident, Malmsey 3 Beta infects .COM and .EXE programs
|
||
when executed. Infected programs will have a file length
|
||
increase of 806 bytes with the virus being located at the
|
||
end of the file. The file's date and time in the DOS disk
|
||
directory listing will not be altered. The following
|
||
following message may be displayed by the virus when an
|
||
infected program is executed:
|
||
"Gotcha!
|
||
|
||
[MALMSEY HABITAT v3.<2E>]
|
||
Lucifer Messiah -- ANARKICK SYSTEMS"
|
||
These text strings are encrypted within the viral code.
|
||
Origin: Canada March, 1993.
|
||
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|