ANTI A Virus

Alias:---
Strain:ANTI Virus Strain
detected when:---
where:USA
Classification:Link virus
Length:1348 Bytes + 1 Jump table entry

Preconditions

Operating System(s):MacOS proprietary
Version/Release:all versions
Computer model(s):Apple Macintosh: all models
Caroname:ANTI.A

Attributes

Easy identification:The strings "ANTI" and "#000001" can be found in CODE 1 resource

Type of Infection:

All those having a CODE 0 and 1 resource with size of old CODE 1 + virus <= 32768 bytes.

Infection Technique:CODE 1 is increased by 1348 bytes
Infection Trigger:Running an infected application to get in memory. Use of OpenResFile
Storage Media affected:
Interrupts hooked:OpenResFile, MountVol
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:
Encoding Method:
Damage:If MountVol is called for a disk drive, this virus searches the first sector of track 16 for the string $16+"%%S" at offset 8 from begin of sector (works only on 400K and 800K floppies); if this string is found, virus executes the code in that sector via JSR call. (No such code has been discovered until classification date)
Damage Trigger:Invocation of MountVol
Particularities:Detects files infected with ANTI B and modifies them to become ANTI Variant
Similarities:ANTI B, ANTI Variant

Agents

Countermeasures:Use an anti-viral product (public domain or commercial) such Disinfectant, Interferon, Virus detective or VirusRx to scan for virus signature.
Standard means:

Acknowledgements

Location:Virus Test Center, University Hamburg, Germany
Classification by:Ronald Greinke
Documentation by:Ronald Greinke
Date:17-December-1991
Information Source:---

(c) 1996 Virus-Test-Center, University of Hamburg