Hafenstrasse-3 Virus (25-July-1992)
Entry...............: Hafenstrasse-3 Virus
Standard CARO name..: Hafenstrasse.1191
Alias(es)...........: ---
Virus Strain........: Hafenstrasse virus strain
Virus detected when.: July 1992
              where.: Hamburg
Classification......: Direct action EXE-infector
Length of Virus.....: 1187-1202 Bytes appended to files
--------------------- Preconditions -----------------------------------
Operating System(s).: IBM PC & Compatibles
Version/Release.....: DOS 2.x and above
Computer model(s)...: IBM PC, XT, AT and hiogher, and compatibles
--------------------- Attributes --------------------------------------
Easy Identification.: ---
Scan signature......: String: 3d 00 10 73 14 fe 84 03 01 e8 28 02 e8
                         1f 00 may be found at an offset of about 
                         1150 bytes from the end of the file.
Type of infection...: Virus uses standard methods of infecting EXE
                         files searched for in the current path.
Infection Trigger...: Upon starting an infected program, virus 
                         searches for an EXE file.
Storage media affected: Only files in subdirectories included in 
                         path are affected.
Interrupts hooked...: ---
Damage..............: Permanent damage: ---
                      Transient damage: the first time an infected 
                         program is started, virus will display an 
                         ambulance car crossing the screen until it 
                         reaches the right border, where it will 
                         crash against a wall displaying texts 
                         "BOOM" and "no more RedX !!!"
Damage Trigger......: The first time an infected program is started.
Particularities.....: 1) This virus does not infect COM files with an 
                         Ambulance car dropper, as does the previous-
                         ly found Hafenstrasse-2. Instead, this
                          variant contains a modied ambulance car
                         routine.
                      2) The vector of INT 26 is tested, whether it 
                         points to a segment above $1000 or not. 
                         As in all (known) Hafentrasse viruses, file
                         and date will not be changed on infection.
Similarities........: Hafenstrasse variants, Ambulance (RedX) variants.
--------------------- Agents -----------------------------------------
Countermeasures.....: ---
Countermeasures successful: F-PROT 2.04a
Standard means......: Delete and replace infected files.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Toralv Dirro
Documentation by....: Toralv Dirro
Date................: 21-July-92
Information Source..: Original virus analysis.

.