Kampana Boot Virus (20-FEB-1993)
Entry...............: Kampana Boot Virus
Alias(es)...........: Antitelefonica = Antitel Boot Virus
Virus Strain........: Kampana Virus Strain
Virus detected when.: Summer 1991 
              where.: Spain
Classification......: Boot Virus, memory resident, stealth
Length of virus.....: 1) Length in memory: 1024 bytes
                      2) Lenght on media:  1024 bytes = 2 sectors
--------------------- Preconditions ------------------------------------
Operating system(s).: MS-DOS
Version/release.....: 2.0 and higher
Computer model(s)...: All MS-DOS machines
--------------------- Attributes ---------------------------------------
Easy identification.: Start of infected boot-sector contains empty
                         entries (8*" ") as manufacturer-ID  and DOS-ID.
                         This is readable ONLY if booted from a clean 
                         disk.
Type of infection...: Self-Identification: Word 9EBCh at offset 4Ah in
                         the infected boot-sector (=location where
                         the encrypted message starts)
                      Hard disk #1 infected by Kampana file virus:
                         boot virus is written to HD position at 
                         head 0, track 0, sector 1 and 6; the old
                         boot sector is moved to sector 7.
                      The virus will enter at top of memory during
                         boot process and will intercept INT13h.
Infection trigger...: Every access to a non-write-protected diskette
                         will infect it (via INT 13h).
Storage media affected: FD in drive A: and B:
Interrupts hooked...: INT13h
Damage..............: Permanent damage: virus writes garbage 
                         (from 0000:0000h) to all sectors on all floppy
                         disk drives (or harddisks) many times.
                      Transient damage: Virus displays the text:
                         "Campaa Anti-TELEFONICA (Barcelona)",0ah,0dh
Damage trigger......: Every 400th boot.
Particularities.....: Virus intercepts INT13h to control any access
                         to itself, so the original content is displayed.
                         Changed content is displayed ONLY if booted 
                         from a clean disk.
--------------------- Agents -------------------------------------------
Countermeasures.....: Very difficult because of encryption / stealth!
Countermeasures successful: ---
Standard means......: FindViru, F-Prot, Scan (etc)
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Daniel Loeffler
Documentation by....: Daniel Loeffler
Date................: January 25, 1993
Information Source..: Reverse-Engineering of virus code

.