Invisible Virus (31-July-1993)
Entry...............: Invisible Virus 
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: Spring 1993
              where.: Italy
Classification......: System (MBR) and File (COM,EXE) Infector,
                         memory resident, slightly tunnelling
Length of Virus.....: 1.Length (Byte) on storage medium:
                        1a. Length in COM files:         2926 Bytes
                        1b. Length in EXE files:         2926+15 Bytes
                        1c. Length of MBR:                  7 sectors.      
                      2.Length (Byte) in RAM: 
                        2a. when loaded from file:       3456 bytes
                        2b. when loaded from MBR:        4096 bytes.
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS
Version/Release.....: 
Computer model(s)...: IBM PCs and compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: ---
Type of infection...: File infection: virus infects COM and EXE files
                         if the normal way (appending).
                      Self-Identification in file: checksum 
                         of entrypoint.
                      System infection: virus makes itself memory
                         resident, using TWIXT method when loaded from 
                         a file, or TOP when loaded by MBR.
                      Self-Identification in memory: virus checks
                         for specila value in INT 21 register.
Infection Trigger...: Executing, opening, renaming or mode changing
                         a COM or EXE file; virus avoids certain files
                         by doing a checksum on the name.
Storage media affected: Infects MBR on disks, and COM or EXE files on
                         disk or diskette. Does NOT infect floppy boot
                         records.
Interrupts hooked...: INT 21 (functions 2521,3521,4B00,3D,43,56,1C)
                        (during boot from infected MBR only, later
                         unhooked)
Damage..............: Permanent Damage: Overwrites some files instead 
                         of infecting.  The replacement code displays 
                         some song lyrics (see below) and plays noise 
                         on the speaker.
                      Transient Damage: Virus plays some noise on the
                         speaker. Trojanized files display message:
                                "I'm the invisible man,
                                 I'm the invisible man,
                                 Incredible how you can
                                 See right through me.
                                 I'm the invisible man,
                                 I'm the invisible man,
                                 It's criminal how I can
                                 See right through you."
                         This text is encrypted in virus, but not in 
                         Trojanized files.
Damage Trigger......: Permanent Damage: Complex and pseudo-random, but 
                         becoming more likely with time-since-infection.
                      Transient Damage: Execution of trojanized file.
Particularities.....: 1) Not stealth, and only slightly tunnelling in
                         attempting to hide INT 21 being intercepted.
                      2) Mildly polymorphic both on files and MBR.
                      3) Virus contains the following text which is NOT
                         displayed: "The Invisible Man - Written in 
                         SALERNO (ITALY), October 1992.  Dedicated to 
                         Ester: I don't know how or when, but I will 
                         hold you in my arms again.". Text encrypted.
INTERRUPTS_HOOKED: 21/2521, 21/3521, 21/4B00, 21/3D, 21/43, 21/56,
                   1C (during boot from infected MBR only, later
                   unhooked)
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: 
--------------------- Acknowledgement ----------------------------------
Location............: IBM High Integrity Computing Lab, Hawthorne N.Y.
Classification by...: David M. Chess, IBM HICL
Documentation by....: David M. Chess, IBM HICL
                      Klaus Brunnstein (VTC, Virus Catalog entry)
Date................: 31-July-1993
Information Source..: Reverse analysis of virus code

.