"DATACRIME Ia" Virus (15-Feb-1990)
Entry...............: DATACRIME Ia
Alias(es)...........: DATACRIME 1168-Version = "1168 Virus"
Virus Strain........: DATACRIME
Virus detected when.:
              where.:
Classification......: Link-virus (extending), direct action
Length of Virus.....: .COM file: file length increases by 1168 byte
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: ---
Type of infection...: System: no infection.
                      .COM file: Link-virus, increases COM files by
                           1168 Bytes. A .COM- File is recognized as 
                           being infected if the time entry of the 
                           last program modification shows the fol-
                           lowing particularities: the last signifi-
                           cant three bytes of the minutes are the
                           same as the seconds. Bit 4,5 of the
                           seconds will be set to zero. For example
                           (H=Hours, M=Minutes, S=Seconds)
                               H H H H H M M M M M M S S S S S
                               ? ? ? ? ? ? ? ? 1 0 1 ? ? ? ? ?
                           will be changed to
                               H H H H H M M M M M M S S S S S
                               ? ? ? ? ? ? ? ? 1 0 1 0 0 1 0 1
                      .EXE file: no infection.
Infection Trigger...: Every time the virus run it looks for another
                           uninfected .COM- file using the DOS-func-
                           tions Findfirst/Findnext in the current
                           directory or any lower directory. If 
                           there is no file that can be infected the
                           virus looks at the drive C: D: A: B: (in
                           this order).
Interrupts hooked...: Int 24 (only when infecting a file)
Damage..............: Permanent Damage: the virus shows the message
                           "DATACRIME VIRUS
                            RELEASED: 1 MARCH 1989"
                           then the first hard disk will be format-
                           ted (track 0, all heads). When formatting
                           is finished the speaker will beep (end-
                           less loop).
Damage Trigger......: if the clock device is October the 13th or 
                           later (any year).
Particularities.....: 1. The message "DATACRIME... 1989" is encrypted.
                      2. The virus detects a hard disk if the segment 
                              of Int 41 is not zero.
                      3. Cause of a mistake in the code the virus will
                              not use it's format buffer.
                      4. Cause of a missing segment override Int 24
                              can not be restored every time.
                      5. If the 7th letter of the programname is a 'D',
                              the program will not be infected
                              (e.g. COMMAND.COM).
Similarities........: The differences between Datacrime Ia and Ib 
                      are minimal.
--------------------- Agents -----------------------------------------
Countermeasures.....: ---
- ditto - successful: ---
Standard means......: ---
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Michael Reinschmiedt
Documentation by....: Michael Reinschmiedt
Date................: 14-Feb-1990

.