"Dark Avenger" Virus (15-Feb-1990) Entry...............: Dark Avenger Alias(es)...........: --- Virus Strain........: Dark Avenger Virus detected when.: November 1989 where.: USA Classification......: February 1990 Length of Virus.....: about 1800 Bytes --------------------- Preconditions ----------------------------------- Operating System(s).: DOS Version/Release.....: Computer model(s)...: IBM-compatible --------------------- Attributes -------------------------------------- Easy Identification.: Two Texts: "Eddie lives...somewhere in time" at beginning and "This Program was written in the City of Sofia (C) 1988-89 Dark Avenger" near end of file Type of infection...: Link-virus COM-files: appends to the program and installs a short jump EXE-files: appends to the program at the beginning of the next paragraph Infection Trigger...: COM and EXE files are corrupted on any read attempt even when VIEWING!!! Storage media affected: Any Drive Interrupts hooked...: Int 21 DOS-services Int 27 Terminate and Stay Resident Damage..............: Overwrites a random sector with bootblock Damage Trigger......: each 16th infection; counter located in Bootblock Particularities.....: - Similarities........: - --------------------- Agents ------------------------------------------ Countermeasures.....: NONE! All data can be destroyed !!!! There is no way in retrieving lost data. Backups will most probably be destroyed too. Countermeasures successful: install McAfee's SCANRES. Standard means......: Good luck! Hopefully the virus did not destroy too many of your programs and data. --------------------- Acknowledgement --------------------------------- Location............: VTC Uni Hamburg Classification by...: Matthias Jaenichen Documentation by....: Matthias Jaenichen Date................: 31.01.1990 Information Source..: --- .