|
NCSA Virus Report #46
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
???????????????????????????????
? VIRUS REPORT ?
? Dark Avenger ?
???????????????????????????????
Synonyms: Black Avenger
Date of Origin: September, 1989.
Place of Origin: Sofia, Bulgaria. First isolated at U.C. Davis.
Host Machine: PC compatibles.
Host Files: Remains resident. Infects COMMAND.COM, EXE, COM, overlay
files.
Increase in Size of Infected Files: 1800 bytes.
Nature of Damage: Affects system run-time operation. Corrupts program or
overlay files. Directly or indirectly corrupts file linkage.
Detected by: Scanv36+, F-Prot, IBM Scan, Pro-Scan.
Removed by: M_DAV, CleanUp, F-Prot.
The Dark Avenger originated in Sofia, Bulgaria, and was probably
imported to the U.S. in September, 1989 by some visiting math professors
at U.C. Davis. It was first reported by Randy Dean at the U.C. Davis
bookstore.
It not only infects generic COM and EXE files, but will also infect
COMMAND.COM. Only files larger than 1,774 bytes will be infected<Note:
Most of the technical information in this section was provided by Daniel
Kalchev, of Bulgaria>. Once in COMMAND.COM, the virus will even
replicate through the DOS COPY and XCOPY commands, with both the source
and destination files being infected in the COPY process. The virus has
been named the Dark Avenger because this code appears within the virus.
The virus contains the words <197> "The Dark Avenger, copyright 1988,
1989" and the message <197> "This program was written in the city of
Sofia. Eddie lives.... Somewhere in Time!"
The Dark Avenger increases the length of infected COM files by 1,800
bytes. EXE files are rounded up to the next "paragraph", and the virus
is appended.
The Dark Avenger stays resident in memory (via manipulation of
memory control blocks) and infects files via many DOS functions (such as
open, close, exec). For this reason, a file may become infected not only
when it is executed but even when viewed with PC Tools, when located with
some "FileFind" program, or when copied with COPY or XCOPY. During copy
commands, both source and target files become infected.
When the Dark Avenger loads into memory, it begins by destroying the
resident portion of COMMAND.COM, which causes reloading of the transient
portion. At this time, the virus has already hooked the necessary
interrupt and COMMAND.COM is infected first.
Although it stays resident, the Dark Avenger can't be detected by
many programs such as MAPMEM, MI, SMAP, and others. This is because when
a such a program is executed, the virus finds the program's own memory
control block (MCB) and changes it in a way that it looks like the last
of the chain of the MCBs (originally the MCB points to the next MCB in
which virus is located). This hint is especially designed to deceive
programs such as MAPMEM.
In addition, in the boot sector, two variables are maintained (at
offset 0x08 and 0x0A). The latter is a counter to 15 (initialized to
major version of current PC/MS-DOS). It is incremented each time an
infected program is executed. When the counter reaches 16, the number
from the first variable is used to select a random disk sector, which is
then overwritten by the virus. If this sector is used by a file, the file
is destroyed. Should the directory sector be selected and overwritten,
the results are most unpleasant.
When the Dark Avenger installs itself, it scans the ROMs of
additional controllers to find the address of the INT 0x13 handler (the
virus knows how it begins and looks for its own first bytes). After that,
it directly calls this address. As a result, it can't be detected by a
program waiting for INT 0x13. The Dark Avenger uses INT 0x26 for this,
and is detected by many antivirus programs (such as ANTI4US) with this
interrupt. The virus affects functions of PC/MS-DOS such as "SetVector"
and "Terminate And Stay Resident".
If anti-virus software attempts to set some of the virus's vital
interrupts via "SetVector", the Dark Avenger will prohibit this. If the
anti-virus software directly changes the vector table, when the software
terminates (via "Terminate And Stay Resident"), the virus restores its
vectors.
As an extremely infectious virus, treat it cautiously. Power down
the system with the on/off switch. Re-boot from a write-protected system
master diskette. Run SCAN or some other scanner to determine the extent
of infection. The virus could conceivably be widespread. A disinfector
(M_DAV), written by Morgan Schweers, is available on the National
Computer Security Association's BBS that can remove this virus.<Note:
The board number is 202 364-1304.> Be sure to re-scan the disk after you
think you are finished with disinfection.
??????????????????????????????????????????????????????????????????????
? This document was adapted from the book "Computer Viruses", ?
? which is copyright and distributed by the National Computer ?
? Security Association. It contains information compiled from ?
? many sources. To the best of our knowledge, all information ?
? presented here is accurate. ?
? ?
? Please send any updates or corrections to the NCSA, Suite 309, ?
? 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS ?
? and upload the information: (202) 364-1304. Or call us voice at ?
? (202) 364-8252. This version was produced May 22, 1990. ?
? ?
? The NCSA is a non-profit organization dedicated to improving ?
? computer security. Membership in the association is just $45 per ?
? year. Copies of the book "Computer Viruses", which provides ?
? detailed information on over 145 viruses, can be obtained from ?
? the NCSA. Member price: $44; non-member price: $55. ?
? ?
? The document is copyright © 1990 NCSA. ?
? ?
? This document may be distributed in any format, providing ?
? this message is not removed or altered. ?
??????????????????????????????????????????????????????????????????????
|
|
