🚀 go-pugleaf

We received a copy of this virus, which is believed to have been found
recently in Australia, 0n Oct 14th.  The following notes are based on
a preliminary analysis, and many parts have not been analysed in
detail.

The virus is an alternating .EXE and Master Boot Record infector, and
will only run on ATs and PCs with an 80286 or later microprocessor.
It is a complex virus, and analysis has been made more difficult by
the inclusion of many 80286 specific instructions.  It has a number of
unusual features, and several nasty tricks which will cause the user
serious inconvenience.  It claims to be destructive, but this appears
to be bluff.

When an infected file is run the virus looks for the "AT" flag in the
BIOS (FC at address FFFF:000Eh).  If this is found (and the MBR is not
already infected) the virus overwrites the original MBR, without
saving it, and writes 12 more sectors to track zero, head zero,
starting at sector three.  It also writes zeroes to bytes 34 & 35 in
the CMOS RAM.  These two bytes are subsequently used as an elapsed
time counter, which determines when the various nasty tricks come into
play.  These bytes are defined as "Reserved", and apparently are
normally unused.

The virus then disinfects the original file (whether or not it
infected the hard disk) and writes the clean version back to the
original disk.  It then loads the original program and permits it to
run normally.

When a PC with an infected hard disk is booted the virus goes
resident, reserving 7K at the top of memory, and traps Ints 8, 9, 11,
17 & 21.  Int 8 (timer tick) is used to increment the counter in CMOS
RAM each minute.  This enables various nasty tricks after different
delays.

The Int 21 handler looks for functions 30 (Get version no), 4b (Load &
execute), and 4e (Find first).  It appears that the virus only infects
files returned by 4e (Find First) and only if they are .EXE files
between 8000 & 327,680 bytes in length.  If this is correct it is a
very ineffective infection procedure.  We certainly had trouble
getting infected samples.  When a file is infected the length is
increased by (decimal) 6672 bytes.

The other interrupts are used to harrass the user.  After the virus
has been present for 10 days and 10 hours the Int 9 (keyboard) handler
will occasionally randomly either ignore keystrokes, or trigger a
RESET.

After 13 days and 13 hours Int 21, function 4b (Load & execute a
program) will sometimes cause a message stating that the hard disk is
being formatted to appear. Meanwhile random sectors are read, so that
the disk light remains on, but it appears that no damage is actually
done.

After 15 days & 15 hours Int 21, function 30 (Get DOS version) will
always return version 2.0, and this will cause many programs to abort.

VET 7.06 can detect this virus, and restore infected files.  It cannot
safely disable the virus, so it will ask the user to reboot from a
clean disk if the virus is detected in memory.  If the Master Boot
Record is infected, and VET has been previously installed for the PC,
VETHDFIX can put back the saved copy of the MBR.  Otherwise VET can
replace it with a "Plain Vanilla" boot sector.  This will normally
work perfectly, but we cannot guarantee it will work on all PCs.

Roger Riordan.  CYBEC Pty Ltd              Ph: +61 3 521 0655
PO Box 205, Hampton. Vic 3188  AUSTRALIA   Fax +61 3 521 0727