Green Caterpillar Virus (15-July-1991)
Entry...............: Green Caterpillar (A/B/C) Virus
Alias(es)...........: "1575/1591" (15xx) Virus
Virus Strain........: Caterpillar
Virus detected when.: January 1991
              where.: Ontario, Canada
Classification......: Resident Program (COM & EXE) Infector
Length of Virus.....: Program: 1575 Bytes (modulo 16:1575-1591)
                      Memory:  1760-1840 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MSDOS
Version/Release.....: Version 3.00 and upwards
Computer model(s)...: IBM-Compatibles (only in Real-Mode)
--------------------- Attributes -------------------------------------
Easy Identification.: Text-String found "C:\COMMAND.COM $$$$$"
Type of infection...: Memory: virus installs itself in high memory,
                         but will not protect itself against being
                         overwritten in RAM (A-Variant).
                      COM & EXE files: one COM AND one EXE file are
                         infected upon infection triggered; file-date
                         will be changed to system-Date.
                      COMMAND.COM will be infected immediatly after
                         execution.
Infection Trigger...: Any time a COPY or DIR-Command is executed
Storage media affected: Any media, infection of current path.
Interrupts hooked...: INT 21h; INT 24h; corrupts COPY and DIR commands
Damage..............: Transient damage: a green caterpillar creeps over
                         the screen, starting at the upper left corner.
Damage Trigger......: Two month after 1st infection.
Particularities.....: There are three variants reported:
                         B-Variant installs itself in memory, includ-
                            ing self-protection against overwrite.
                         C-Variant is able to infect a program during
                            its execution. 
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures.....: Scan (>V73); VirScan; F-Prot
Countermeasures successful: Scan (>V73); VirScan; F-Prot
Standard means......: Boot from clean system-disk, restore COMMAND.COM,
                         delete all infected files; hide COMMAND.COM 
                         in a separate directory, and use the COMSPEC-
                         entry in the CONFIG.SYS file to avoid re-
                         infection of COMMAND.COM.
--------------------- Acknowledgement --------------------------------
Location............: Virus-Test-Center; University Hamburg, Germany
Classification by...: Matthias Jaenichen, VTC
                        <jaenichen@rz.informatik.uni-hamburg.dbp.de>
Documentation by....: Matthias Jaenichen, VTC
Date................: 15-July-1991
Information Source..: Disassembly, Vsum9103 (Patricia Hoffman)

.