Hafenstrasse-2 Virus. (25-July-1992)
Entry...............: Hafenstrasse-2 Virus
Standard CARO name..: Hafenstrasse.1641
Alias(es)...........: Hafenstrasse.e, Red-X-Exe
Virus Strain........: Both Hafenstrasse & Ambulance (Red-X) strains
Virus detected when.: June 92
              where.: Hamburg
Classification......: Direct action EXE- and COM-infector 
Length of Virus.....: 1637-1652 Bytes appended to files
--------------------- Preconditions ----------------------------------
Operating System(s).: IBM & Compatibles
Version/Release.....: DOS 2.x and above
Computer model(s)...: IBM PC, XT, AT and higher, and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: Heavily increased time to access disk, when
                         starting an infected program.
Search string.......: String 3D 00 10 73 1B FE 84 D9 04 06 E8 can be
                         found at about 600 bytes offset from the end.
Type of infection...: EXE-files: standard ways of infecting EXE-files.
                      COM-files: virus behaves as trojan dropper in
                                 releasing Ambulance=Red X virus.
Infection Trigger...: Starting an infected file: virus will search
                         for 1 EXE- and 1 COM-file in path to infect.
Storage media affected: Only files in subdirectories included in the
                         path are infected.
Interrupts hooked...: ---
Damage..............: Permanent damage: system may hang when nearly
                         all files are infected (see Particularities)
                      Transient damage: on COM-files, virus will cause 
                         an ambulance car to cross the screen. 
Damage Trigger......: On COM files: first time on 6th, then every 8th 
                         execution of virus (infection counter).
Particularities.....: 1) First virus to drop a virus from another
                         virus strain (Ambulance car=Red X). 
                      2) Virus will check, if the INT-26-vector points
                         to an adress with a segment above $1000; in
                         this case, it will not activate (trying to 
                         undergo some online detectors, e.g. Flushot).
                      3) If the files in the PATH are (almost) all 
                         infected, the system may hang, because it 
                         continues to search for infected files and 
                         uses a random function to determine, whether 
                         to infect a yet uninfected file.
                      4) No exact match is done do recognize COM- and 
                         EXE-files.
                      5) File date and time is not altered.
Similarities........: Hafenstrasse variants, Ambulance car variants 
                         (both virus strains use very similar ways to 
                         search for a file, to infect; they may come 
                         from related authors).
--------------------- Agents -----------------------------------------
Countermeasures successful: F-PROT 2.04a, Antivir from H&B-EDV 
Standard means......: Delete and replace infected files.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Toralv Dirro
Documentation by....: Toralv Dirro
Date................: 07-July-1992
Information Source..: Original virus analysis

.