Horns Virus (31-July-1993)
Entry...............: Horns Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: 
              where.: 
Classification......: File virus (appending AVR infector),stealth,
                         memory resident 
Length of Virus.....: 1.Length (Byte) on storage medium: 624 Bytes
                      2.Length (Byte) in RAM:            896 Bytes
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS
Version/Release.....: 
Computer model(s)...: IBM PCs and compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: Virus code contains message (not displayed):
                         "[Horns Of Jericho (c) 92 Crom-Cruach/Trident]"
Type of infection...: Appending AVR file infector: virus infects .AVR 
                         files opened for read-only when file is being 
                         closed. Virus appends itself (624 bytes) to 
                         end of an infected file and recalculates .AVR
                         specific checksum to bypass AVR integrity check.
                         Remark: AVR format is COM-like, but starts at 
                            offset 0000h rather than 0100h; an AVR file
                            is loaded to XXXX:0000, where XXXX is ar-
                            bitrary segment. Module's entry point is at 
                            offset +48h.
                         Self-identification in file:  File[0x48] = 0xE9
SELFREC_IN_MEMORY: INT_21;AX=44A0 -> AH=FF
                      System infection: upon execution of an infected 
                         file, virus makes itself memory resident using
                         TWIXT method.
                         Self-identification in memory: special content 
                            of register upon INT 21 invocation.
Infection Trigger...: Infection occurs when the following conditions
                         hold: (Open for Read-Only + Close) 
                            AND FileName[0..1]=='C:'
                            AND FileExt=='.AVR' AND File[0x48] != 0xE9 
                            AND File[0x41..0x43]==0x000100 
                            AND (File[0x3c..0x3d] & 0xf)==0 
Storage media affected: Virus infects only files on disk drive C:
Interrupts hooked...: INT 21 (functions 3D00, 3E, 44A0)
Damage..............: Permanent Damage: none (except infection)
                      Transient Damage: An infected AVR module will 
                         report correct result (whether a file being 
                         scanned is infected or not) with a probability 
                         1/4. In 3/4 of cases, it will report "not 
                         infected" regardless on actual state. IN FACT, 
                         due to a bug, an infected .AVR will always
                         report "not infected".
Damage Trigger......: (BIOS_TIMER_TICKS & 03) != 0 
Particularities.....: 1) Stealth method: Recalculates the AVR checksum 
                         for an infected file, to undergo AVR integrity
                         check.
                      2) Virus is distributed by dropper HORNS.COM.
                      3) AVR file format was used some time ago by some
                         scanners (e.g. TBScan) but is no longer used.
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: None (at publication time) 
Standard means......: Delete infected file, replace with clean file.
--------------------- Acknowledgement ----------------------------------
Location............: Program Systems Institute, Russian Academy of
                         Sciences, Pereslavl-Zalessky, Russia
Classification by...: Dmitry O. Gryaznov
Documentation by....: Dmitry O. Gryaznov
                      Klaus Brunnstein (VTC, Virus Catalog entry)
Date................: 21-July-1993
Information Source..: Reverse analysis of virus code

.