|
NCSA Virus Report #100
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
???????????????????????????????
? VIRUS REPORT ?
? nVIR ?
???????????????????????????????
Host Machine: Macintosh.
nVIR is a Macintosh virus that has now led to numerous strains,
including MEV#, AIDS, nFLU, and nVIR A and B.
When you run an application infected with nVIR A or B on a clean
system, the infection spreads from the application to the system file.
After rebooting, the infection in turn spreads from the system to other
applications, as they are run. The effect can be devastating (see
sidebar).
At first, nVIR A and B only replicate. When the system file is first
infected, a counter is initialized to 1000. The counter is decremented
by 1 each time the system is booted, and it is decremented by 2 each time
an infected application is run.
When the counter reaches 0, nVIR A will sometimes either say "Don't
Panic" (if MacinTalk is installed in the system folder) or beep (if
MacinTalk is not installed in the system folder). This will happen on a
system boot with a probability of 1/16. It will also happen when an
infected application is launched with a probability of 31/256. In
addition, when an infected application is launched, nVIR A may say
"Don't Panic" twice or beep twice, with a probability of 1/256.
When the counter reaches 0, nVIR B will sometimes beep. nVIR B does
not call MacinTalk. The beep will happen on a system boot with a
probability of 1/8. A single beep will happen when an infected
application is launched with a probability of 15/64. A double beep will
happen when an infected application is launched with a probability of
1/64.
It is possible for nVIR A and nVIR B to mate and sexually reproduce,
resulting in new viruses combining parts of their parents.
For example, if a system is infected with nVIR A, and if an
application infected with nVIR B is run on that system, part of the nVIR
B infection in the application is replaced by part of the nVIR A
infection from the system. The result contains part from each of its
parents, and behaves like nVIR A.
Similarly, if a system is infected with nVIR B, and if an application
infected with nVIR A is run on that system, part of the nVIR A infection
in the application is replaced by part of the nVIR B infection from the
system. The result is very similar to its sibling described in the
previous paragraph, except that it has the opposite "sex" - each part is
from the opposite parent. It behaves like nVIR B.
These offspring are new viruses. If they are taken to a clean system
they will infect that system, which will in turn infect other
applications. The descendents are identical to the original offspring.
Incestual matings of these children with each other and with their
parents produce results that contain various combinations of parts from
their parents.<Note: This material prepared by John Norstad, Academic
Computing and Network Services.>
??????????????????????????????????????????????????????????????????????
? This document was adapted from the book "Computer Viruses", ?
? which is copyright and distributed by the National Computer ?
? Security Association. It contains information compiled from ?
? many sources. To the best of our knowledge, all information ?
? presented here is accurate. ?
? ?
? Please send any updates or corrections to the NCSA, Suite 309, ?
? 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS ?
? and upload the information: (202) 364-1304. Or call us voice at ?
? (202) 364-8252. This version was produced May 22, 1990. ?
? ?
? The NCSA is a non-profit organization dedicated to improving ?
? computer security. Membership in the association is just $45 per ?
? year. Copies of the book "Computer Viruses", which provides ?
? detailed information on over 145 viruses, can be obtained from ?
? the NCSA. Member price: $44; non-member price: $55. ?
? ?
? The document is copyright © 1990 NCSA. ?
? ?
? This document may be distributed in any format, providing ?
? this message is not removed or altered. ?
??????????????????????????????????????????????????????????????????????
|
|
