Article View: comp.virus
Article #3092Syrian Brain II (PC)
From: Mr Brenton Judge
Date: Thu, 05 Nov 1992 03:47
Date: Thu, 05 Nov 1992 03:47
17 lines
1335 bytes
1335 bytes
I had a call last night from a user whos machine was reporting that whilst his executables existed in directory listings, when he tried to run them DOS reported that it was a "Bad command or file name", every time he ran a file from the HD, and then after that every time he ran a file from the HD or his floppy. After getting him to upload the first executable that was run in his autoexec.bat from his HD, it was easy to find a virus which had its name clearly marked out as the Syrian Brain II virus. I had a quick look at the virus, and given the simplicity of the viral code (infect everything that the user tries to run after virus hooks int 21H) and the number of errors in the programming which would cause most of its messages to become corrupt, I wondered if this was as the name suggests a Syrian virus, or is it far more likely that its one made here. Has anyone else ever come across it? Brenton Judge
Technical Details
Message-ID:
<0007.9211101943.AA07075@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: int477k@lindblat.cc.monash.edu.au (Mr Brenton Judge) Newsgroups: comp.virus Subject: Syrian Brain II (PC) Message-ID: <0007.9211101943.AA07075@barnabas.cert.org> Date: 5 Nov 92 03:47:37 GMT Sender: virus-l@lehigh.edu Lines: 17 Approved: news@netnews.cc.lehigh.edu