Hafenstrasse Virus (20-Nov-1991)
Entry...............: Hafenstrasse Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: 22-October-1991
              where.: Hamburg, Germany
Classification......: Program virus, non-resident, EXE-infector
Length of Virus.....: 809 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM - PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: ---
Type of infection...: The virus infects only EXE files. The virus
                         is not memory-resident.
Infection Trigger...: The virus infects in direct action; when an in-
                         fected program is run, virus tries 5 times
                         to find a file to infect, but will only in-
                         fect one file at a time.
Interrupts hooked...: ---
Damage..............: The message "Hafenstrasse bleibt !" is written
                         to a hidden file. The name of the file is
                         composed of 4 randomly-chosen letters. Even 
                         though this seems to be fairly harmless, 
                         this will eventually fill the disk, or the 
                         capacity of the directory may be exceeded.
                      Remark: the text "Hafenstrasse bleibt!" (=har-
                         bour street remains) is a slogan which some 
                         inhabitants (belonging to an "alternative 
                         scene") of Hamburg's "harbour street" use 
                         to publicly withstand local government plans
                         to replace their old houses by new ones.
Damage Trigger......: A new file is created every time an infected 
                         file is run.
Particularities.....: The text is encrypted (only the text).
--------------------- Agents -----------------------------------------
Countermeasures.....: ---
- ditto - successful: ---
Standard means......: ---
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Morton Swimmer
Documentation by....: Morton Swimmer
Date................: 20-November-1991

.