134 lines
6.9 KiB
Plaintext
134 lines
6.9 KiB
Plaintext
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
||
³ VIRUS REPORT ³
|
||
³ Lehigh ³
|
||
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
|
||
|
||
Date of Origin: late 1987.
|
||
|
||
Place of Origin: Lehigh University, Pennsylvania.
|
||
|
||
Host Machine: PC compatibles.
|
||
|
||
Host Files: Remains resident. Infects COMMAND.COM.
|
||
|
||
Increase in Size of Infected Files: overwrites files.
|
||
|
||
Nature of Damage: Corrupts program or overlay files. Overwrites the FAT
|
||
and boot sector after infecting four floppies.
|
||
|
||
Detected by: Scanv56+, F-Prot, IBM Scan, Pro-Scan.
|
||
|
||
Removed by: CleanUp, or use MDisk and replace COMMAND.COM with a clean
|
||
copy, or use F-Prot.
|
||
|
||
Scan Code: 50 53 80 FC 4B 74 08 80 FC 4E 74 03 E9 77 01 8B DA 80 7F 01 3A
|
||
75 05 8A 07 EB 07. You can also search at offset 01CH for B4 19 CD 44 04
|
||
61 1E 51 52 57.
|
||
|
||
History: This is a COMMAND.COM infector that first surfaced at Lehigh
|
||
University in late 1987. It is one of the best known of viruses, and
|
||
widely discussed and analyzed.
|
||
|
||
Description of Operation: Infects only COMMAND.COM, where it overwrites
|
||
the stack space. If a disk which contains an uninfected copy of
|
||
COMMAND.COM is accessed, that copy is also infected. A count of
|
||
infections is kept within each copy of the virus, and when this count
|
||
reaches 4, every disk (including hard disks) currently in the computer
|
||
is trashed by overwriting the initial tracks (boot sector & FAT).
|
||
Infection changes the date and time of the infected file. If a floppy
|
||
with an uninfected COMMAND.COM is write-protected, there will be a
|
||
"WRITE PROTECT ERROR" message from DOS.
|
||
|
||
I have reprinted below the warning that Kenneth van Wyk distributed
|
||
on this virus.
|
||
|
||
"WARNING: MS-DOS COMMAND.COM "virus" program will
|
||
reformat your disks!!
|
||
|
||
"Last week, some of our student consultants discovered a virus
|
||
program that's been spreading rapidly throughout Lehigh University. I
|
||
thought I'd take a few minutes and warn as many of you as possible
|
||
about this program since it has the chance of spreading much farther
|
||
than just our University. We have no idea where the virus started, but
|
||
some users have told me that other universities have recently had
|
||
similar problems.
|
||
|
||
"The virus: the virus itself is contained within the stack space of
|
||
COMMAND.COM. When a PC is booted from an infected disk, all a
|
||
user need do to spread the virus is to access another disk via TYPE,
|
||
COPY, DIR, etc. If the other disk contains COMMAND.COM, the virus
|
||
code is copied to the other disk. Then, a counter is incremented on the
|
||
parent. When this counter reaches a value of 4, any and every disk in
|
||
the PC is erased thoroughly. The boot tracks are nulled, as are the FAT
|
||
tables, etc. All Norton's horses couldn't put it back together again... :-)
|
||
This affects both floppy and hard disks. Meanwhile, the four children
|
||
that were created go on to tell four friends, and then they tell four
|
||
friends, and so on, and so on.
|
||
|
||
"Detection: while this virus appears to be very well written, the
|
||
author did leave behind a couple footprints. First, the write date of the
|
||
COMMAND.COM changes. Second, if there's a write protect tab on an
|
||
uninfected disk, you will get a WRITE PROTECT ERROR... So, boot up
|
||
from a suspected virus'd disk and access a write protected disk - if an
|
||
error comes up, then you're sure. Note that the length of
|
||
COMMAND.COM does not get altered.
|
||
|
||
"I urge anyone who comes in contact with publicly accessible disks
|
||
to periodically check their own disks. Also, exercise safe computing -
|
||
always wear a write protect tab.
|
||
|
||
"This is not a joke. A large percentage of our public site disks has
|
||
been gonged by this virus in the last couple days."<Note: Kenneth R. van
|
||
Wyk, User Services Senior Consultant, Lehigh University Computing
|
||
Center, (215)-758-4988>
|
||
|
||
The Lehigh original virus has been sporadically reported at dozens
|
||
of installations outside of the university for over a year. It is not a
|
||
particulary successful replicator <197> probably because of the
|
||
extremely short activation fuse - and it is difficult to detect and
|
||
report because there are few symptoms prior to activation. But there
|
||
should certainly be no surprise that it's in the public domain.
|
||
|
||
John McAfee has written: "The belief that viruses can be contained by
|
||
early counter-action is belied by the Lehigh University experience. I
|
||
have spoken to a number of individuals at the University who belived
|
||
that the virus had somehow been contained because "no copies of the
|
||
virus were distributed to outside organizations". This assumed, of
|
||
course, that the original virus writer gave up after being foiled at
|
||
Lehigh and did not insert the virus at any other location, and that all
|
||
copies of the virus at Lehigh had indeed been accounted for. The first
|
||
issue rests solely in the hands of the perpetrator and is beyond any
|
||
containment controls. The second issue relies on an error-free
|
||
containment process - allowing no possibility for overlooking, losing or
|
||
mistaking an infected diskette. In any case, the Lehigh virus was by no
|
||
means contained. I received a copy, as did virtually every virus
|
||
researcher, in mid-1988, and infection reports issued throughout the
|
||
year from universities, corporations and individual computer users."
|
||
|
||
|
||
ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ»
|
||
º This document was adapted from the book "Computer Viruses", º
|
||
º which is copyright and distributed by the National Computer º
|
||
º Security Association. It contains information compiled from º
|
||
º many sources. To the best of our knowledge, all information º
|
||
º presented here is accurate. º
|
||
º º
|
||
º Please send any updates or corrections to the NCSA, Suite 309, º
|
||
º 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS º
|
||
º and upload the information: (202) 364-1304. Or call us voice at º
|
||
º (202) 364-8252. This version was produced May 22, 1990. º
|
||
º º
|
||
º The NCSA is a non-profit organization dedicated to improving º
|
||
º computer security. Membership in the association is just $45 per º
|
||
º year. Copies of the book "Computer Viruses", which provides º
|
||
º detailed information on over 145 viruses, can be obtained from º
|
||
º the NCSA. Member price: $44; non-member price: $55. º
|
||
º º
|
||
º The document is copyright (c) 1990 NCSA. º
|
||
º º
|
||
º This document may be distributed in any format, providing º
|
||
º this message is not removed or altered. º
|
||
ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|