| Alias: | Fish Boot |
| Strain: | - |
| detected when: | |
| where: | |
| Classification: | Master-boot record (HD) infector, DBR (Floppy)- infector |
| Length: | 2 kilobyte(s) |
Preconditions | |
| Operating System(s): | MS-DOS |
| Version/Release: | None |
| Computer model(s): | PC's |
| Caroname: | Chinese_Fish |
Attributes | |
| Easy identification: | |
Type of Infection: | Bootsector infection. Selfrec in memory: None Selfrec on disk: (M,F)BR[B3h..B4h] = 15h 20h |
| Infection Technique: | |
| Infection Trigger: | Int13Read, Int13WriteINFECTION_CRIT: |
| Storage Media affected: | Harddisks, Disketts |
| Interrupts hooked: | 13h |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | Transient: Display of message (see below) Permanent: None |
| Damage Trigger: | Transient: Int13 and (Year>= 1992) and (DayOfWeek mod 10 = 1) Permanent: n/a |
| Particularities: | Removal of Stoned.Michelangelo (see comments) Displayed text: " Hello! I am FISH, please don't kill me.Congratulate 80th year of the Republic OfChina Building,Fish will help to kill stoneWritten by Fish in NTIT. TAIWAIN 80.10.18" Not displayed text: None The message above is displayed in the top right cornerof the screen, in inverse video, every time INT 13h iscalled if the year is 1992 or later, and the day numberends in 1 (eg: 21st).The claim in the message that "Fish will help to killstone" is only partially true. If, during boot-up, thevirus finds the Stoned.Michelangelo self-recognitionsignature in the hard disc MBR, it checks that Michel-angelo's hidden copy of the MBR (at 0.0.7) is infectedwith Chinese_Fish itself. If so, 0.0.7 is written backover 0.0.1, thus obliterating Michelangelo, and restoringFish to viral primacy!The FBR is stealthed on infected floppies. On hard disc,the virus stealths 0.0.1 to 0.0.10 (Fish's hiding placefor the old MBR), whilst 0.0.8..0.0.10 (the entirearea used by the virus) is stealthed to 0.0.11. |
| Similarities: | |
Agents | |
| Countermeasures: | |
| Standard means: | |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, FRG |
| Classification by: | Paul Ducklin |
| Documentation by: | Paul Ducklin |
| Date: | |
| Information Source: | Caroentry (autom.converter by S.Freitag) |
(c) 1996 Virus-Test-Center, University of Hamburg