Exe_Bug.A Virus (20.February-1993)
Entry...............: Exe_Bug.A Virus
Alias(es)...........: CMOS Virus  
Virus Strain........: Exe_Bug Virus Strain
Virus detected when.: 
              where.: South Africa (there common in January 1993)
Classification......: Memory-resident System (MBR,FBR) infector, 
                         stealth, tunnelling.
Length of Virus.....: 1.Length (Byte) on media:  1 sector
                      2.Length (Byte) in memory: 1 kByte
--------------------- Preconditions ------------------------------------
Operating System(s).: MS-DOS 
Version/Release.....: 
Computer model(s)...: IBM PCs and compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: ---
Type of infection...: Self-Identification in memory: ---
                      Self-Identification on disk: MBR[28h] = 7Ch
                      System infection: MBR/FBR infector; saving original
                         boot sector at 0/0/17 (HD), at 40/0/1 (360 kB)
                         and at 80/0/1 (any other floppy).
Infection Trigger...: At bootup from an infected floppy (hard);
                         during INT 13h/AH=02 (floppy)
Storage media affected: HD/FD
Interrupts hooked...: INT 13h/02, INT 13h/03 (stealth mechanism)
Damage..............: Permanent Damage: Sectors on hard drive converted 
                                        to disc-trashing trojan; sectors 
                                        on floppies converted to virus-
                                        dropping trojan.
                      Transient Damage: ---
Damage Trigger......: Permanent Damage: Condition=Int13h/write AND sect=3
                                        AND buffer[0]='M' AND
                                       ((disc=hard AND 512<=trk<768) OR 
                                        (disc=flop AND sect=3))
                      Transient Damage: ---
Particularities.....: CMOS setup is altered to reflect "drive A: not 
                         installed", causing some BIOSes to give up 
                         bothering to boot from floppy. Virus is thus 
                         able to subvert a clean boot by attempting 
                         floppy bootup *after* loading itself from the
                         hard drive.
Similarities........: Exe-Bug.Hooker Virus
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: 
--------------------- Acknowledgement ----------------------------------
Location............: 
Classification by...: Paul Ducklin 
Documentation by....: Paul Ducklin (CARObase)
                      Klaus Brunnstein (conversion to CVC format)
Date................: 1993-February-15
Information Source..: Reverse-Engineering of virus code

.