Headcrash Virus (15-July-1991)
Entry...............: Headcrash Virus
Alias(es)...........: "1067" Virus
Virus Strain........: ---
Virus detected when.: University Giessen (Germany)
              where.: March 1991
Classification......: .COM - file:  RAM-resident program virus
Length of Virus.....: .COM - Files: 1067 bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM - PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: .COM files: first three bytes (E9h WXh YZh) and
                           last three bytes are identical. The seconds
                           field of the timestamp is changed to
                           62 sec, similar to Vienna strain.
Type of infection...: RAM-resident: infected if function AX=58CCH of 
                           INT 21H is available in system (carry flag
                           not set).
                      .COM file: infected by hooking EXEC-function.
                           If a program is executed, the virus infects
                           the first not-infected .COM file found
                           in the directory of the executed file; it
                           apends 1067 bytes at the end of the file.
                           Only files with extension .COM and with
                           1791 < filesize < 61696 bytes are infected.
                           Files are infected not more than once.
                      .EXE file: no infection.
Infection Trigger...: System will be infected if day is odd and
                           DOS version > 1.00 .
                      .COM file will be infected, when function 4B00H
                           (LOAD/EXEC) of INT 21H is called.
Interrupts hooked...: INT 09H,21H,24H; INT 21H (functions 4B00H, 
                           2521H, 3521H, 58CCH and 58DDH);
                      INT 09H only during execution of infected files;
                      INT 24H only during infection of files.
Damage..............: Permanent Damage: Every time a file is executed 
                         in an infected system, a .COM file will be 
                         infected.
                      Transient Damage: Only once per installation of
                         virus before execution of a file, the fol-
                         lowing message is displayed:
                         "Headcrash Industries celebrate 0040hex."
                         (0040H is the infection counter,and may vary)
Damage Trigger......: If a file is executed between 20 and 25 minutes
                         after virus installation AND if realtime 
                         clock was not read before virus installation 
                         AND if infection counter > 31, then this
                         message is displayed.
Particularities.....: - The message "Headcrash.....hex." is encrypted.
                      - All files with .COM extension will be infected
                        (i.e also exe-files with .COM extension).
                      - .COM files with exe-header-id "MZ" will not
                        run after infection.
                      - Command.com will be infected.
                      - At infection of COMMAND.COM, the free memory
                        is temporally shrinked to 64k byte; therefore,
                        many programs will no longer execute. 
                      - File attributes are restored after infection.
                      - Get/Set interrupt 21H (functions 3521H,2521H)
                        is monitored and modified by virus.
                      - Function AX=58DDH of INT 21H returns:
                           CX = codesegment of virus,
                           ES/BX = segment/offset of old int 21H.
--------------------- Agents -----------------------------------------
Countermeasures.....: Category 3: NTI1067.EXE (VTC Hamburg)
- ditto - successful: NTI1067.EXE finds and restores infected programs.
Standard means......: Notice .COM file length and seconds-timestamp.
                      Search for hex bytes: 01H,B4H,2AH,CDH,21H,F6H,
                         C2H,01H,75H,03H at location 62 of virus.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Stefan Tode
Documentation by....: Stefan Tode
Date................: 15-July-1991

.