Mabuhay Virus (31-July-1993)
Entry...............: Mabuhay Virus
Alias(es)...........: ---
Virus Strain........: --- 
Virus detected when.: Mid 1993
              where.: Manila, Philippines
Classification......: File Virus (COM,EXE Infector), Memory resident
Length of Virus.....: 1.Length (Byte) on media: 2660 (+16) Bytes
                      2.Length (Byte) in RAM:   2688 Bytes
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS
Version/Release.....: DOS 2.0 or later
Computer model(s)...: IBM PCs and Compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: ---
Type of infection...: File infection: Infexts COM and EXE files by 
                         appending itself to file.
                      Self-Identification in files: Compares entry 
                         point code with its own code.
                      System infection: Upon executing an infected file,
                         virus makes itself resident in low memory.
                      Self-Identification in memory: test for given
                         value in INT 21 register.
Infection Trigger...: Once resident, any file executed will be infected.
Storage media affected: 
Interrupts hooked...: INT 21
Damage..............: Permanent Damage: Virus damages EXE/COM files of
                         opposite type as it checks only file extension.
                      Transient Damage: Plays music and displays color
                         graphic an following text on screen:
                      "June 12 - the Independence Day of the Philippines.
                                ++
                                *   ++
                                        ++
                                   \|/      ++
                                  -----     *   ++++++++++++++++++
                                   /|\      ++
                                        ++
                                *   ++
                                ++
                                     MABUHAY ANG PILIPINAS!
                                   Dedicated to Manong Eddie."
                         The image in the middle (displayed in graphic, 
                            above approximated in ASCII) displays the 
                            Philippine flag and is blue on top, red 
                            below with a gray (gray background and 
                            yellow foreground) field inside horizontal
                            V (">") on left side of the flag.
Damage Trigger......: Permanent Damage: ---
                      Transient Damage: June 12th, any year
Particularities.....: 1) Message is encrypted in virus.
                      2) Virus was captured by integrity check on 
                         several machines in metro Manila.  It is "in the
                         wild" in Philippines and not detected by 
                         scanners existing in July 1993.
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....:
Countermeasures successful: No scanner detects this virus on publication
Standard means......: Delete infected file and replace by clean one.
--------------------- Acknowledgement ----------------------------------
Location............: Stiller Research, Tallahassee Florida
Classification by...: Wolfgang Stiller
Documentation by....: Wolfgang Stiller (CAROBase entry)
                      Klaus Brunnstein (Virus Catalog entry)
Date................: 15-July-1993
Information Source..: Reverse analysis of virus code

.