| Alias: | KEYBGR Trojan |
| Strain: | |
| detected when: | November 1987 |
| where: | West Germany |
| Classification: | |
| Length: | |
Preconditions | |
| Operating System(s): | |
| Version/Release: | |
| Computer model(s): | All MS-DOS machines |
| Caroname: | MtE.Dedicated.Scrambler |
Attributes | |
| Easy identification: | The Trojan contains many copies of the string "nothing". |
Type of Infection: | |
| Infection Technique: | |
| Infection Trigger: | |
| Storage Media affected: | |
| Interrupts hooked: | INT 9 is captured for the host program, and INT 1C is used for the damage. |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | A smiley face moves in a random fashion about the screen displacing characters as it moves. The face is either ascii 2 or 1 with a 50% probability. |
| Damage Trigger: | About 60 minutes after the trojan keybgr is started. |
| Particularities: | --- |
| Similarities: | --- |
Agents | |
| Countermeasures: | --- |
| Standard means: | --- |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, FRG |
| Classification by: | Morton Swimmer |
| Documentation by: | Morton Swimmer |
| Date: | June 30, 1990 |
| Information Source: | --- |
(c) 1996 Virus-Test-Center, University of Hamburg