INIT 1984 Virus

Alias:---
Strain:---
detected when:March 1992
where:Ireland
Classification:Link virus, files of type INIT;stealth (attempt)
Length:INIT ID 1984 bytes

Preconditions

Operating System(s):MacOS proprietary
Version/Release:System 4.1 or greater
Computer model(s):Apple Macintosh: all models
Caroname:INIT_1984

Attributes

Easy identification:INIT ID 1984; STR ID 1984 "SCULLEY MUST DIE!"

Type of Infection:

All files of type "INIT"

Infection Technique:INIT ID 1984 4342 bytes
Infection Trigger:Executing an infected INIT. The virus has a counter in STR ID 1984; depending on its value, the virus tries to infect another INIT within 6 seconds, and subsequently tries to deactivate SAM Intercept.
Storage Media affected:
Interrupts hooked:None
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:
Encoding Method:
Damage:Transient damage: --- Permanent damage: several actions: Renaming all files to random 8 byte names; files to be renamed will be choosen in alphabetical order, so some files will be renamed more than once while some won't be renamed at all. Changing Type and Creator to random 4 byte values; Changing creation and modification date to January 1st, 1904. Files that can't be renamed (when filename exists or new name contains ":") will be deleted.
Damage Trigger:Running an infected system on any Friday-13th.
Particularities:The virus tries to deactivate SAM Intercept but it searches for the wrong file type.
Similarities:---

Agents

Countermeasures:Use of a commercial anti-viral product or a public domain utility such as Virus detective or Disinfectant >=2.8 to carry out virus signature scans.
Standard means:

Acknowledgements

Location:Virus Test Center, University Hamburg, Germany
Classification by:Thomas Piehl
Documentation by:Ronald Greinke
Date:13-July-1992
Information Source:

(c) 1996 Virus-Test-Center, University of Hamburg