Alabama Virus

Alias:
Strain:---
detected when:October 1989
where:Israel
Classification:Resident, appending EXE infector.
Length:1) Length on media: 1408 bytes

Preconditions

Operating System(s):MS-DOS
Version/Release:2.xx and above
Computer model(s):IBM PC, XT, AT and compatibles
Caroname:Alabama.A

Attributes

Easy identification:---

Type of Infection:

Appends itself to the executed file.

Infection Technique:
Infection Trigger:Any INT 21h load/execute function-call.
Storage Media affected:
Interrupts hooked:INT 21h function 4Bh (load and execute); INT 24h.
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:
Encoding Method:
Damage:Permanent damage: --- Transient damage: One hour after the start of an infected program, the following message will be displayed: "SOFTWARE COPIES ARE PROHIBITED BY INTERNATIONAL LAW", "Box 1055 Tuscambia ALABAMA USA" The message is encrypted by the NOT function.
Damage Trigger:Permanent damage: --- Transient damage: 1 hour after starting an infected program.
Particularities:---
Similarities:---

Agents

Countermeasures:Skulasons F-PROT 2.06a, McAfee SCAN V99.
Standard means:Reboot and delete infected files.

Acknowledgements

Location:Virus Test Center, University of Hamburg, Germany.
Classification by:Michael Haack
Documentation by:Michael Haack
Date:01-FEB-1993
Information Source:Virus-code analysis

(c) 1996 Virus-Test-Center, University of Hamburg