Joshi Virus (25-July-1992)
Entry...............: Joshi Virus
Alias(es)...........: Joshua Virus
Virus Strain........: ----
Virus detected when.: ?
              where.: India, Germany
Classification......: Master Bootsector and Bootsector Virus, 
                         memory resident, stealth
Length of Virus.....: 4 KByte
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: any
Computer model(s)...: IBM - PC, XT, AT, upward and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: CHKDSK will report 6KB memory less than 
                         installed.
                      On hard disks, the Master Bootsector contains
                         EB 1F 90 as first Bytes; at end of sector 3
                         and beginning of sector 4 on track 0, string
                         "Type Happy Birthday Joshi" can be found.
Type of infection...: Hard disk: Master Bootsector will be infected;
                         the original Master-Bootsector will be saved
                         in sector 9. The virus resides on track 0,
                         sectors 1-8.
                      Floppy-Disk: Bootsector will be infected; the
                         original Bootsector will be saved on additio-
                         nal track 40/80 in sector 9. Virus resides 
                         on track 40/80 in sectors 2 to 6. On 720 kB
                         diskettes, virus will overwrite original 
                         data on track 40.
Infection Trigger...: Actions: Read, write, verify track 0/sector 1
Storage Media affected: Any hard disk, any floppy
Infection targets:..: Hard disk Master Bootrecord; Floppy Bootrecord
Interrupts hooked...: INT 8, INT 9, INT 13h, INT 21h
Interrupts used.....: INT 8, INT 9, INT 10H, INT 13h, INT 19h
Damage..............: Permanent damage: on 720 kByte floppies, 
                         original data on track 40 will be overwrit-
                         ten during infection.
                      Transient damage: virus displays message 
                         "Type Happy Birthday Joshi".
Damage Trigger......: On January 5th, a DOS call (INT 21h) of any
                        of the following functions
                        - 48h (memory allocation)
                        - 49h (free allocated memory block)
                        - 4Ah (resize allocated memory block)
                        - 2Ah (get date)
                        - 2Bh (set date)
                        - 2Ch (get time)
                        - 2Dh (set time)
Particularities.....: 1) Joshi prevents being overwritten by the
                         STONED-virus
                      2) With Hercules graphic cards, problems may 
                         occur as JOSHI does not save Hercules screen 
                         memory.
--------------------- Agents -----------------------------------------
Countermeasures.....: According to their documentation, many antivirus
                         products claim to recognise/eradicate virus.
-ditto- successful..: Tested: Dr.Solomon's Toolkit 4.15,
                         Fridrik Skulason's F-PROT 2.04a,
                         H&B-EDV Antivir-IV 4.03 and McAfee Scan93.
Standard means......: 1) Reboot from clean bootdisk.
                      2) Use SYS-Command to reinstall BOOT sector on
                         floppies.
                      3) Use FDISK /MBR to reinstall Master-BOOT
                         sector on Harddisk (MS-DOS 5.0 only).
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center Hamburg, Univ Hamburg, Germany
Classification by...: Torsten Dargers, Ulf Heinemann
Documentation by....: Torsten Dargers, Ulf Heinemann
Date................: 26-June-1992

.