"Hey You" Virus (20-FEB-1993)
Entry.................: "Hey You" Virus
Alias(es).............: 923, 928 Virus
Virus Strain..........: ---
Virus detected when...: February 1991
              where...: Bulletin Board, Slovenia
Classification........: Program (.COM, .EXE) infector, memory resident
Length of Virus.......: 1) Length on media:  928 (3A0h) - 943 bytes
                        2) Length in memory: 944 bytes
---------------------- Preconditions -----------------------------------
Operating System(s)...: MS/PC-DOS
Version/Release.......: 2.00 and upwards
Computer model(s).....: All IBM PC compatibles
----------------------- Attributes -------------------------------------
Easy Identification...: Virus contains text (message displayed):
                          "Hey, YOU !!!
                           Something's happening to you ! 
                           Guess what it is ?!
                           HA HA HA HA ..."
Self identification...: System: infected if INT 21h function BBBBh 
                           returns value 6969h in AX-register.
                        .COM files: checks if first byte of file
                           is jump (E9h), calculates jump destination
                           and then compares file contents at destination
                           with first nine bytes of the virus.
                        .EXE files: calculates entry point and compares
                           file contents with first nine bytes of virus.
Type of infection.....: System: Virus first checks MCB if there will 
                           be at least 64Kb available after installing
                           itself in memory. It then copies itself at
                           the top of available memory and decreases 
                           the value of available memory by 3Bh 
                           paragraphs (=944 bytes).
                        Files: virus appends itself at end of .COM 
                           (including COMMAND.COM) and .EXE files,
                           enlarging file size between 928 and 943
                           bytes. Files will only be infected once.
Infection Trigger.....: Calling INT 21h (EXEC) function 4B00h 
Storage media affected: Files can be infected on all media (HD,FD)
Interrupts hooked.....: INT 21h (functions 4B00h and BBBBh),
                        INT 24h (only during infection of a file)
Damage................: Permanent damage: ---
                        Transient damage: When an infected program is 
                           executed, computer beeps (^G), displays 
                           the message described above (see: Easy
                           Identification) and exits to DOS.
Damage Trigger........: Transient damage: if during infection function
                           GetDate returns with year>=1991 AND month>=2
                           AND day>=25 AND (Mem[0:46Ch] AND 7=0) 
                           (Real Time Clock).
Particularities.......: INT 21h is set directly (not via DOS) and
                           always points to xxxx:00B5h. 
                        EXE files with maximum memory requirement equal
                           FFFFh paragraphs will not be infected. 
                        Attribute, time and date of an infected file
                           remain unchanged. Read-only and hidden
                           attributes do NOT protect against infection.
Similarities..........: ---
----------------------- Agents -----------------------------------------
Countermeasures.....: F-Prot v2.02 recognizes the virus as "Hey You";
                      McAfee's Scan v80+ recognizes it as "923 virus
                      [923]", McAfee's Scan v89B recognizes it as
                      "Generic Virus [GenF]".
Countermeasures successful: Tested: F-Prot v2.03a detects and removes
                                    the virus.
Standard means......: ---
--------------------- Acknowledgement ----------------------------------
Location............: ---
Classification by...: Dalibor Cerar
Documentation by....: Dalibor Cerar
Date................: 16-April-1992
Information Source..: (original virus analysis)

.