Last-Year Virus (31-July-1993)
Entry...............: Last-Year Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: 
              where.: 
Classification......: File virus(appending COM infector),memory resident
Length of Virus.....: 1.Length (Byte) on storage medium: 604 Bytes
                      2.Length (Byte) in RAM:            880 Bytes
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS 
Version/Release.....: 
Computer model(s)...: IBM PCs and compatibles 
--------------------- Attributes ---------------------------------------
Easy Identification.: ---
Type of infection...: Self-Identification methods: 
                         File infection: infects COM files by appending 
                            it's code. For self-identification, tests
                            whether 4th and 5th byte is "88 31".
                         System infection: virus makes itself memory 
                            resident via TWIXT method. For self-identi-
                            fication, virus checvks whether 2 bytes 
                            before the byte that the INT21 vector points
                            to are "61 6D". Can therefore load more than
                            once if another INT21-hooker intervenes.
Infection Trigger...: Finding an executable file and if DS:DX ends 
                         in "COM".
Storage media affected: 
Interrupts hooked...: Int 21: functions 4B, 0A, 2A 
Damage..............: Permanent Damage: none
                      Transient Damage: INT21 handler subtracts one 
                          from the year on INT21/2A (Get Date) calls.
Damage Trigger......: Permanent Damage: none
                      Transient Damage: Always
Particularities.....: 1) No side effects, except transient damage and 
                         usual MCB-munging due to TWIXT method.
                      2) Virus code is rather explicit in handling 
                         (ignoring) write-protect errors in INT 24
                         handler but coding of INT 21 handler shows
                         some unused flag; potentially more variants
                         are intended.
Similarities........: --- 
--------------------- Agents -------------------------------------------
Countermeasures.....: Not tested
Countermeasures successful: Not tested
Standard means......: 
--------------------- Acknowledgement ----------------------------------
Location............: IBM High Integrity Computing Lab, Hawthorne N.Y.
Classification by...: David Chess, IBM HICL
Documentation by....: David Chess, IBM HICL (CAROBase entry)
                      Klaus Brunnstein, VTC (Virus catalog entry)
Date................: June 24, 1993
Information Source..: Reverse analysis of virus code

.