| Alias: | |
| Strain: | - |
| detected when: | |
| where: | |
| Classification: | COM and EXE infector, resident |
| Length: | 2688 |
Preconditions | |
| Operating System(s): | MS-DOS |
| Version/Release: | DOS 2.0 or later |
| Computer model(s): | PC's |
| Caroname: | Mabuhay |
Attributes | |
| Easy identification: | |
Type of Infection: | The virus appends itself to the files Selfrec in memory: Int_21h;AH=EFh -> 025Bh Selfrec on disk: Compare of entry point code with self |
| Infection Technique: | |
| Infection Trigger: | Once resident, any file executed will be infected. |
| Storage Media affected: | |
| Interrupts hooked: | 21h |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | - |
| Encoding Method: | |
| Damage: | Transient: Music and screen display Permanent: None |
| Damage Trigger: | Transient: System date = June 12 of any year, virus isresident and a program is executed. Permanent: |
| Particularities: | The virus resides as a TSR The virus uses the prefetch queue of the CPU to determine if it is being traced. Virus checks only file extension so it will damage.EXE or .COM files of the opposite type. Displayed text: On June 12th, each program executed after the virusis resident in memory will display:"June 12 - the Independence Day of the Philippines.ßß* ßßßß\³/ ßßÄÄÄÄ * ßßßßßßßßßßßßßßßßßß/³\ ÜÜÜÜ* ÜÜÜÜMABUHAY ANG PILIPINAS!Dedicated to Manong Eddie.",Encrypted. The image in the middle is the philippine flag andis blue on top, red below with a gray (gray background and yellow foreground)field inside the horizontal V (">") on the left side of the flag. Thisdisplays the name of the President of the Phillipines, Fidel V. Ramon,Manong Eddie for short. Music plays while the graphic is displayed. Thismusic is the Philippine National Anthem, "Land of the Morning" This virus was captured by integrity check on severalmachines in metro Manila. It is in the wild and notdetected by scanners existing in July 1993. |
| Similarities: | |
Agents | |
| Countermeasures: | |
| Standard means: | |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, FRG |
| Classification by: | Wolfgang Stiller (Stiller Research) |
| Documentation by: | Wolfgang Stiller |
| Date: | 1993/07/15 |
| Information Source: | Caroentry (autom.converter by S.Freitag) |
(c) 1996 Virus-Test-Center, University of Hamburg