116 lines
5.9 KiB
Plaintext
116 lines
5.9 KiB
Plaintext
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||
³ VIRUS REPORT ³
|
||
³ Alameda Virus ³
|
||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||
|
||
Synonyms: Yale, Merritt, Peking, Seoul virus.
|
||
|
||
Date of Origin: Spring, 1987.
|
||
|
||
Place of Origin: Merritt College, Alameda, California.
|
||
|
||
Host Machine: PC compatibles. Does not run on 80286.
|
||
|
||
Host Files: Remains resident. Infects floppy disk boot sector.
|
||
|
||
Increase in Size of Infected Files: n/a.
|
||
|
||
Nature of Damage: Resident. Corrupts or overwrites floppy boot sector.
|
||
|
||
Detected by: Scanv56+, F-Prot, IBM Scan.
|
||
|
||
Removed by: CleanUp, MDisk, F-Prot, or DOS SYS command..
|
||
|
||
Scan Code: BB 40 00 8E DB A1 13 00 F7 E3 2D E0 07 8E C0 0E 1F 81 FF 56 34
|
||
75 04 FF 0E F8 7D. You can also search at offset 00EH for A1 13 00 F7 E3
|
||
2D E0 07.
|
||
|
||
History: First discovered at Merritt college in California in the Spring
|
||
of 1987. In February, 1988, it popped up at Alameda College, where it
|
||
received large publicity. In October, 1988, it surfaced at Yale
|
||
University, where it became known as the Yale virus. The original
|
||
version caused no intentional damage.
|
||
|
||
The original Alameda would only run on an 8088/8086, and was
|
||
presumably assembled using A86 on such a machine. Because it does not
|
||
infect hard disks, we may presume that the author's machine did not have
|
||
one. The original version would not run on an 80286 or an 80386 machine,
|
||
although it will infect on such a machine. Later versions of the virus
|
||
can run on an 80286.
|
||
|
||
Description of Operation: The Alameda virus spends its life in the boot
|
||
sector of 5.25" 360K floppy disks. When the machine boots from an
|
||
infected 360K floppy, the Alameda becomes memory resident, occupying 1K
|
||
of memory. It infects 360K floppies in the A: drive only. Pressing
|
||
Ctrl-Alt-Del activates the virus, rather than removing it from memory.
|
||
At this point, it looks for a floppy in drive A: to infect. It will
|
||
infect any 360K disk in that drive, whether or not it is a bootable disk.
|
||
|
||
The original boot sector is held in track thirty-nine, head zero,
|
||
sector eight. It does not map this sector bad in the FAT (unlike the
|
||
Brain) and should that area be used by a file, the virus will die. It
|
||
apparently uses head 0, sector 8 and not head 1 sector 9 because this is
|
||
common to both single sided and double sided formats and common to both
|
||
8-sectored and 9-sectored formats (both the old 160K single sided and
|
||
later 180K single sided formats).
|
||
|
||
Alameda redirects the keyboard interrupt (INT 09H) to look for
|
||
Ctrl-Alt-Del sequences. When it detects Ctrl-Alt-Del, it will attempt to
|
||
infect any floppy it finds in drive A:.
|
||
|
||
The virus is not malevolent. It contains code to format track
|
||
thirty-nine, head zero, but this has been disabled. It also contains a
|
||
count of the number of times it has infected other diskettes, although it
|
||
is referenced for write only and is not used as part of an activation
|
||
algorithm. The virus remains resident at all times after it is booted,
|
||
even if the user removes the floppy from a machine having no bootable
|
||
hard disk, and reboots with Ctrl-Alt-Del. When Ctrl-Alt-Del is pressed
|
||
from inside Cassette Basic, it activates and infects the floppy from
|
||
which the user is attempting to boot.
|
||
|
||
Alameda contains no anti-detection mechanisms as does the Brain
|
||
virus.
|
||
|
||
The Alameda contains a rare POP CS instruction that is not understood
|
||
by 80286 systems, and hangs the system up. The POP CS command is used to
|
||
pass control to itself in upper memory. When such a machine hangs, the
|
||
virus has already installed itself in high RAM and hooked the keyboard
|
||
interrupt, so that the infection can spread if a warm boot is then
|
||
performed.<Note: In fact, the way the virus is most often discovered is
|
||
that a 286 won't boot from an infected disk.>
|
||
|
||
Removal: Alameda can not only live through an Ctrl-Alt-Del reboot
|
||
command, but this is its only means of reproduction to other floppy
|
||
diskettes. The only way to remove it from an infected system is to turn
|
||
the machine off and reboot with an uninfected copy of DOS. The Norton
|
||
utilities can be used to identify infected diskettes by looking at the
|
||
boot sector and the DOS SYS utility can be used to remove it <197> unlike
|
||
the Brain.
|
||
|
||
|
||
ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
|
||
º This document was adapted from the book "Computer Viruses", º
|
||
º which is copyright and distributed by the National Computer º
|
||
º Security Association. It contains information compiled from º
|
||
º many sources. To the best of our knowledge, all information º
|
||
º presented here is accurate. º
|
||
º º
|
||
º Please send any updates or corrections to the NCSA, Suite 309, º
|
||
º 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS º
|
||
º and upload the information: (202) 364-1304. Or call us voice at º
|
||
º (202) 364-8252. This version was produced May 22, 1990. º
|
||
º º
|
||
º The NCSA is a non-profit organization dedicated to improving º
|
||
º computer security. Membership in the association is just $45 per º
|
||
º year. Copies of the book "Computer Viruses", which provides º
|
||
º detailed information on over 145 viruses, can be obtained from º
|
||
º the NCSA. Member price: $44; non-member price: $55. º
|
||
º º
|
||
º The document is copyright (c) 1990 NCSA. º
|
||
º º
|
||
º This document may be distributed in any format, providing º
|
||
º this message is not removed or altered. º
|
||
ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|