| Alias: | |
| Strain: | VCS Virus Strain |
| detected when: | Summer 1992 |
| where: | Bulletin Board, Hamburg, Germany |
| Classification: | Clone of VCS V1.0 Virus Program Virus, direct action; overwr |
| Length: | Increase of file length: 1077 bytes |
Preconditions | |
| Operating System(s): | MS/PC-DOS |
| Version/Release: | |
| Computer model(s): | All IBM PC compatibles with CPU > 8088 |
| Caroname: | VCS.Standard.Manta |
Attributes | |
| Easy identification: | Same as VCS V1.0 virus: Files containing C350h at offset 03h regarded as infected (self identification) Search string at offset 00h: E8 14 00 8A A4 2F 05 8D BC 20 01 B9 0F 04 89 FE |
Type of Infection: | Same as VCS V1.0 virus |
| Infection Technique: | |
| Infection Trigger: | Same as VCS V1.0 virus |
| Storage Media affected: | |
| Interrupts hooked: | --- |
| Stealth: | |
| Tunneling/Selfprot: | |
| Oligo/Polymorphism: | |
| Encoding Method: | |
| Damage: | Same as VCS V1.0 virus: Permanent damage: when triggered, the files 'C:\AUTOEXEC.BAT' and 'C:\CONFIG.SYS' will be overwritten with 512 bytes of text. Transient Damage: when AUTOEXEC and CONFIG.SYS have been overwritten, a text which was deliberately choosen by the installator (see: Particularities:Generating the virus) may be displayed. |
| Damage Trigger: | Same as VCS V1.0 virus |
| Particularities: | VCS V1.0 Manta was generated with the VCS V1.0 (see catalog entry VCS V1.0). In addition to the characteristics of VCS V1.0, the following text will be displayed until a key is pressed: "RAM Parity Error at 0F67:1B2C" "(C)ontinue (S)hut off NMI (R)eboot ". The files C:\AUTOEXEC.BAT and C:\CONFIG.SYS will be overwritten with this text, as well as with the following text referring to popular jokes about some people which drive a special Opel car type called "Manta". The text is: "Ein Mantafahrer haelt an einer Ampel. Neben ihm haelt ein Porsche. Beide kurbeln die Scheiben runter, und der Porschefahrer fragt: 'Was hat vier Beine und ist unheimlich bloed?' Mantafahrer: 'Keine Ahnung' Porschefahrer: 'Du und deine Freundin' An der naechsten Ampel haelt ein Golf neben dem Manta. Mantafahrer: 'Was hat vier Beine und ist unheimlich doof ?' Golffahrer: 'Keine Ahnung' Mantafahrer: 'Meine Freundin und ich'." Translation: "A Manta driver stops at a traffic lights. A Porsche stops beside him. Both of them open the window and the Porsche driver asks: 'What has four legs and is very very mad?' Says Manta driver: 'I do not know' Says Porsche driver: 'You and your girlfriend' At next traffic lights, a Golf stops beside the Manta. Says Manta driver: 'What has four legs and is very very mad ?' Says Golf driver: 'I do not know' Says Manta driver:'My girlfriend and me.' " Moreover, VCS V1.0 Manta uses opcode 68h (push constant on stack) which is not defined on 8088 processors; so, virus will not work on such systems. |
| Similarities: | --- |
Agents | |
| Countermeasures: | Searchstring at offset 00h of virus: E8 14 00 8A A4 2F 05 8D BC 20 01 B9 0F 04 89 FE - ditto - successful. Actual versions of McAfee Scan, Skulason F-PROT, Solomon FindViru. Tode's NTI-VCS.EXE is an antivirus that only looks for VCS virus, and if requested will restore the file. |
| Standard means: | Notice file length. Use ReadOnly attribute. |
Acknowledgements | |
| Location: | Virus Test Center, University Hamburg, Germany |
| Classification by: | Stefan Tode |
| Documentation by: | Stefan Tode and Matthias Jaenichen |
| Date: | 15-July-1991 |
| Information Source: | |
(c) 1996 Virus-Test-Center, University of Hamburg