95 lines
4.5 KiB
Plaintext
95 lines
4.5 KiB
Plaintext
------------------------------
|
||
|
||
Date: 24 January 89, 17:25:02 +0100 (MEZ)
|
||
From: Otto Stolz <RZOTTO@DKNKURZ1.BITNET>
|
||
Subject: Features of Blackjack Virus (PC)
|
||
|
||
Hello,
|
||
|
||
perhaps you remember the virus incident I reported on this list, on 2
|
||
September 88, 14:44:40 +0200 (MESZ). This note is intended to present
|
||
some of the results and insights I gained since. Most of the facts
|
||
presented here have not been detected by myself; rather I have to
|
||
thank several people in the local area, and several VIRUS-L
|
||
subscribers, for their hints and contributions.
|
||
|
||
This virus has been termed "Blackjack", which is a pun on the German
|
||
name "17+4" of the popular card game. Blackjack reveals its existence
|
||
by the length of infected COM-files, which is 1704 Bytes too large.
|
||
|
||
As with the Israeli virus strains, the virus has a two-stage
|
||
life-cycle:
|
||
|
||
- - when you invoke an infected program, Blackjack will infect RAM;
|
||
|
||
- - when Blackjack is active in RAM, it will infect every COM file being
|
||
invoked. This can be exploited for an easy test, e.g.:
|
||
copy con: test.com
|
||
{ALT-144} {ALT-205} {Blank} {CTRL-z} {return}
|
||
dir test.com
|
||
test
|
||
dir test.com
|
||
In the second line above, every brace-pair represents one byte entered;
|
||
if you key in these bytes correctly, you'll read a Capital Letter E
|
||
with Acute Accent, a Horizontal Double-Line Segment, a Blank, a Circum-
|
||
flex Accent, and a Capital Letter Z. The 1st dir-command, above,
|
||
should report that
|
||
TEST.COM is 3 bytes long; if the 2nd dir reports 1707 bytes, instead,
|
||
your RAM, and hence the TEST.COM file, are infected by some virus--most
|
||
probably Blackjack.
|
||
|
||
Blackjack infects only COM-files which are at least 3 Bytes long, and
|
||
it does so only once for any given file. It overwrites the 1st three
|
||
bytes with a JMP to the beginning of the viral code, which is appended
|
||
to the file. The 2 byte address of this JMP instruction is probably
|
||
the reason why only COM files are susceptible to infection. Blackjack
|
||
retains the file's time stamp. It even infects read-only files; on
|
||
write-protected floppy disks, it attempts writing 5 times per file,
|
||
thus revealing its activity.
|
||
|
||
In the infected file, the viral code is cryptographically encoded,
|
||
using a simple Vigenere code depending on the length of the file; only
|
||
the instructions for decoding the encrypted part of the code are in
|
||
plain machine-language. This is obviously intended as a impediment
|
||
against disassembling. Hence, every copy of the virus looks different
|
||
(depending on the length of the file).
|
||
|
||
On invocation of an infected program, Blackjack installs itself in RAM
|
||
(if no copy is already installed), then replaces the JMP instruction
|
||
with its former contents and resumes normal program operation.
|
||
|
||
The storage map shows that Blackjack has tinkered with the free
|
||
storage pointer-chain to hide the fact that it has hooked interrupt
|
||
21. Hence, only a minor part of Blackjack is visible in the storage
|
||
map.
|
||
|
||
In every year, from October to December, Blackjack will interfere with
|
||
CGA or EGA operated screens, moving randomly chosen characters down,
|
||
like falling leaves in autumn. After a while, you'll have a big heap
|
||
of characters at the bottom of your screen, and as you cannot see
|
||
anymore what the computer is trying to display, you'll probably have
|
||
to restart the system. This behaviour has been predicted by two
|
||
people, who have disassembled Blackjack, and has later been observed
|
||
on many EGA-equipped ATs.
|
||
|
||
Together with two students, I have written a VIRCHECK program to check
|
||
for Blackjack in RAM and in disk files. VIRCHECK exploits the
|
||
signaling device Blackjack uses to ensure at most one active copy to
|
||
detect Blackjack in RAM; it searches the files for the few
|
||
instructions which are alike in every copy, to detect infected files.
|
||
At our consultant desk, everybody can obtain a copy of VIRCHECK
|
||
(Pascal source, and EXE-file), plus a 16 kByte memo (in German) and
|
||
the 3 Byte TEST.COM (cf. above).
|
||
|
||
An employee of a nearby software-house, who has detected Blackjack, in
|
||
the 1st time, has circulated a DELVIRUS program to detect Blackjack
|
||
and, optionally, repair infected files (taking the original contents
|
||
of the 1st three bytes from the viral code meant to replace them, as
|
||
explained above. As the DELVIRUS's source is not available to the
|
||
public (nor to myself), we do not distribute this program (nor
|
||
recommend its use).
|
||
|
||
That's it, folks. I hope I didn't bore you.
|
||
Otto
|
||
|
||
[Ed. Thanks for the detailed description, Otto!] |