CHEMNITZ Virus (20-FEB-1993)
Entry...............: CHEMNITZ Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: University of Chemnitz, Germany
              where.: December 1992
Classification......: Memory-resident, appending EXE- and COM-Infector 
Length of Virus.....: 1) Length on media:  772..778 Bytes 
                      2) Length in memory: 848 Bytes
--------------------- Preconditions -----------------------------------
Operating System(s).: MS-DOS, DR-DOS
Version/Release.....: MS-DOS 2.xx upward 
Computer model(s)...: IBM - PC, XT, AT, upward and compatibles
--------------------- Attributes --------------------------------------
Easy Identification.: 1) Enlarged file size: using DIR, compare actual
                         file size with original file size.
                      2) Reduction of available memory: using CHKDSK or
                         MEM, memory size will be reduced by 848 bytes.
                      3) The following signature is found 20Ah (522)
                         bytes before end of every infected file:
                         'FMCIKLMOF' = 46 4D 43 49 4B 4C 4D 4F 46 (hex) 
Type of infection...: It infects previously uninfected EXE and COM files 
                         when loaded with INT 21, function 4B00h by 
                         appending itself to program on media, and 
                         makes itself memory-resident.
                      It infects COM and EXE files only once, but does
                         not infect COMMAND.COM.       
Infection Trigger...: Invocation of INT 21h, Function 4B00h
Interrupts hooked...: INT 21h, function AH=4B (Load&Execute)
Storage media affected: All COM and EXE files (FD,HD) 
                         if not write-protected
Damage..............: Pernament damage: ---
                      Transient damage: ---
Damage Trigger......: ---
Particularities.....: ---
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful:
Standard means......: Boot from clean system; delete infected files and
                         replace with uninfected originals from backup.
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Mark Broecker
Documentation by....: Mark Broecker
Date................: 19-January-1993
Information Source..: Reverse-Engineering of original virus
                      (received from site of first report: U-Chemnitz)

.