🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #3092

Syrian Brain II (PC)

#3092
From: Mr Brenton Judge
Date: Thu, 05 Nov 1992 03:47
17 lines
1335 bytes
	I had a call last night from a user whos machine was reporting
that whilst his executables existed in directory listings, when he
tried to run them DOS reported that it was a "Bad command or file
name", every time he ran a file from the HD, and then after that every
time he ran a file from the HD or his floppy.  After getting him to
upload the first executable that was run in his autoexec.bat from his
HD, it was easy to find a virus which had its name clearly marked out
as the Syrian Brain II virus.  I had a quick look at the virus, and
given the simplicity of the viral code (infect everything that the
user tries to run after virus hooks int 21H) and the number of errors
in the programming which would cause most of its messages to become
corrupt, I wondered if this was as the name suggests a Syrian virus,
or is it far more likely that its one made here.  Has anyone else ever
come across it?

	Brenton Judge
Technical Details
Message-ID: <0007.9211101943.AA07075@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: int477k@lindblat.cc.monash.edu.au (Mr Brenton Judge)
Newsgroups: comp.virus
Subject: Syrian Brain II (PC)
Message-ID: <0007.9211101943.AA07075@barnabas.cert.org>
Date: 5 Nov 92 03:47:37 GMT
Sender: virus-l@lehigh.edu
Lines: 17
Approved: news@netnews.cc.lehigh.edu