| Alias: | Hello_1a, Hall(oe)chen |
| Strain: | |
| detected when: | January 1990 |
| where: | South-West-Germany |
| Classification: | Matthias Jaenichen, Christoph Fischer |
| Length: | 2011 Bytes |
Preconditions | |
| Operating System(s): | MS-DOS |
| Version/Release: | 3.00+ |
| Computer model(s): | IBM compatibles |
| Caroname: | Halloechen.A |
Attributes | |
| Easy identification: | Textstring: "Hall(oe)chen, here I'm" "Acrivate Level 1" (wrong syntax!) |
Type of Infection: | Link-Virus; Infects COM- and EXE-files |
| Infection Technique: | |
| Infection Trigger: | Any program file with file-date different from the system-date (only year/month) |
| Storage Media affected: | Floppy and harddisk |
| Interrupts hooked: | INT 21h, function 4Bh INT 08h and INT 16h for Damage |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | Slows system down, corrupts keyboard-entries (pressing "A" produces "B") |
| Damage Trigger: | Infection-level greater than 50 or 70 |
| Particularities: | The damage will not be activated. |
| Similarities: | --- |
Agents | |
| Countermeasures: | CleanV57+ |
| Standard means: | --- |
Acknowledgements | |
| Location: | VTC-Hamburg, BIT-Karlsruhe |
| Classification by: | |
| Documentation by: | Matthias Jaenichen |
| Date: | 31-January-1990 |
| Information Source: | --- |
(c) 1996 Virus-Test-Center, University of Hamburg