| Alias: | |
| Strain: | - |
| detected when: | |
| where: | |
| Classification: | Master-boot record (HD) infector, DBR (Floppy)- infector, re |
| Length: | 4 kilobyte(s) |
Preconditions | |
| Operating System(s): | MS-DOS |
| Version/Release: | CPU >= 286 [uses PUSHA and POPA], CMOS[for date for payload] |
| Computer model(s): | PC's |
| Caroname: | Peter |
Attributes | |
| Easy identification: | |
Type of Infection: | Bootsector infection. Selfrec in memory: None Selfrec on disk: MBR [0x1FD] == 0xBB, FBR [0x1FD] == 0x11 |
| Infection Technique: | |
| Infection Trigger: | MBR: (Boot) & (MBR[0x1FD]!=0xBB)FBR: (INT13) & (AX==02 | AX==03) &(FBR[0x1FD]!=11) & (FBR[0x18]>=0x0F)[That is, when you boot from an infected floppy,it infects the hard disk unless its mark is alreadythere, and when you use a floppy in A: it getsinfected unless the mark is there, or it hasless than 15 sectors/track.] |
| Storage Media affected: | Harddisks, Disketts |
| Interrupts hooked: | 13/02, 13/03 |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | - |
| Encoding Method: | |
| Damage: | Transient: When the CMOS clock contains 2 and 27 in the monthand date fields, it displays a message, garblespart of the hard disk by XORing with hex 78, andthen asks four questions, in English, about popmusic. (See PERMANENT_DAMAGE) Permanent: If the user answers any of the questionsincorrectly, the virus returns without restoringthe garbled part of the hard disk. If the useranswers correctly, the virus restores the garbledpart of the hard disk and boots normally. (Ihaven't actually tested this.) |
| Damage Trigger: | Transient: CMOS clock bytes 7 and 8 contain 27 and 2. Permanent: User answers a question in the quiz wrong. |
| Particularities: | The virus resides at the top of memory, reducing the BIOS memory size at 0000:0413. The virus resides at the memory address: 9F00:0000 None Displayed text: "Good morning,EVERYbody,I am PETER IIDo not turn off the power, or you will lost all of the data in Hardisk!!!WAIT for 1 MINUTES,please...Ok.If you give the right answer to the following questions,I will save your HD:A. Who has sung the song called "I`ll be there" ?1.Mariah Carey 2.The Escape Club 3.The Jackson five 4.All (1-4):B. What is Phil Collins ?1.A singer 2.A drummer 3.A producer 4.Above all (1-4):C. Who has the MOST TOP 10 singles in 1980`s ?1.Michael Jackson 2.Phil Collins (featuring Genesis)3.Madonna 4.Whitney Houston (1-4):CONGRATULATIONS !!! YOU successfully pass the quiz!AND NOW RECOVERING YOUR HARDISK ......Sorry!Go to Hell.Clousy man!"; Encrypted Not displayed text: None The answers to the questions (see above) are4, 4, 2, at least in the virus's opinion. Thecoding style is very odd and self-taught-looking;he doesn't seem to know about direct addressingmodes, and does things like "MOV BX,0460;MOV [BX],AX" rather than "MOV [460],AX". Forinstance. It's also a "copy-protected" virus, inthat it formats track 0x50 to store the on-diskpart of itself, and the original MBR, on. |
| Similarities: | |
Agents | |
| Countermeasures: | |
| Standard means: | |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, FRG |
| Classification by: | David M. Chess, IBM HICL |
| Documentation by: | David M. Chess, IBM HICL |
| Date: | 93/05/24 |
| Information Source: | Caroentry (autom.converter by S.Freitag) |
(c) 1996 Virus-Test-Center, University of Hamburg