| Alias: | |
| Strain: | FLIP Virus Strain |
| detected when: | July 1990 |
| where: | Germany |
| Classification: | Multipartite (COM, EXE, Boot, MBR); Encrypted |
| Length: | 1) Length on media: 2343 Bytes 2) Length in memory: 3064 Bytes |
Preconditions | |
| Operating System(s): | MS-DOS |
| Version/Release: | Version >=3.0 |
| Computer model(s): | IBM PCs and Compatibles |
| Caroname: | Flip.2343 |
Attributes | |
| Easy identification: | --- |
Type of Infection: | EXE standard append COM standard append MBR standard;the partition size is decreased by 6 sectors. Boot standard |
| Infection Technique: | |
| Infection Trigger: | --- |
| Storage Media affected: | HD and Floppy |
| Interrupts hooked: | INT 01h; INT 10h; INT 13h; INT 1Ch; INT 21h; INT 9Fh |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | Permanent Damage: --- Transient Damage: the screen ist flipped horizontally. A special character set makes the screen look like if one looks from inside out. This effect only works on EGA or VGA displays. |
| Damage Trigger: | Permanent Damage: --- Transient Damage: Effects occur on every 2nd of any month between 16:00 and 16:59. |
| Particularities: | Due to a bug, an early Flip variant is not able to infect bootsectors of diskettes. The Virus could only be distributed by executing an infected file from floppy or by copying an infected file to diskette. |
| Similarities: | Virus in Flip strain |
Agents | |
| Countermeasures: | Various AntiVirus products detect Flip viruses. |
| Standard means: | --- |
Acknowledgements | |
| Location: | Virus Test Center, University of Hamburg, Germany |
| Classification by: | Matthias Jaenichen |
| Documentation by: | (Received from Russian author) |
| Date: | 20-February-1993 |
| Information Source: | Virus documentation |
(c) 1996 Virus-Test-Center, University of Hamburg