MachoSoft-Virus (1-Nov-89)
Entry.................. Macho (=MachoSoft) Virus
Alias(es).............. ---
Strain................. ---
Detected: when......... September 1989
          where........ Wilhelmshaven, West Germany
Classification......... Program Virus (Link virus)
Length of Virus........ 3550-3560 (dec) bytes appended on
                           paragraph boundary
------------------------ Preconditions---------------------------------
Operating System(s).... MS/PC-DOS
Version/Release........ 3.00 and upwards
Computer models........ All IBM PC compatibles.
-------------------------- Attributes--------------------------------- 
Easy identification.... Any string "Microsoft" is replaced with
                        "Machosoft" on the hard disk.
Type of infection...... The virus infects both COM and EXE files.
                           In the case of EXE files, it checks the
                           checksum in the EXE header for 7CB6h, in
                           which case no infection will occure. COM
                           files are checked by looking for the
                           string 39,28,46,03,03,01 (hex) at offset
                           10h. The virus is not RAM resident,
                           therefore it will only infect when the
                           host is run. It infects by searching
                           through the directories on the current
                           drive and randomly choosing files and
                           directories to infect or search. It will
                           not infect any other drive. It will infect
                           COMMAND.COM.
Infection trigger...... None, it will infect any time it is run.
Media affected......... All disks that are addressable using
                           standard DOS functions.
Interrupts hooked...... ---
Damage................. Will replace any occurance of "MicroSoft"
                           with "Machosoft". It does this by using
                           the DOS (not BIOS) interrupts 25h and 26h,
                           and searching the disk from beginning to
                           end, sector by sector. It tries 20h
                           sectors at a time, and stores the last
                           sector infected in the file
                           "\IBMNETIO.SYS", which is marked "system"
                           and "hidden". After reaching the last sector,
                           it will start from the beginning again.
Damage trigger......... Every time the host is run.
Particularities........ The virus checks for the environment
                           variable "VIRUS=OFF", in which case it
                           will not infect. The virus in encrypted
                           using a variable key.
                           The virus will only do damage after January 1,
                           1985.
                           The virus has some trouble searching the
                           directories. Most of the effort go into
                           infecting the beginning of the disk. Macho
                           may not even reach the end of the disk on
                           larger systems.
                           As the programmer was otherwise very
                           professional in his programming, we may
                           see a version with a better directory
                           searching algorithm soon.
                           I've been told that DOS interrupts 25h and
                           26h are no longer supported by Microsoft
                           in DOS 4.0. This would obviously have its
                           consequences.
Similarities........... ---
---------------------------- Agents----------------------------------- 
Countermeasures........ Use the environment variable described
                           above as a first aid measure only. If your
                           COMMAND.COM in infected, that wont stop
                           the virus much. Resetting the date will
                           only stop the damage, not the infection.
                           Here's one of the few strings that can
                           safely be searched for:
                             50,51,56,BE,59,00,B9,26,08,90,D1,E9,8A,E1,
                             8A,C1,33,06,14,00,31,04,46,46,E2,F2,5E,59
- ditto - successful... For proper treatment, my Anti-Virus
                           "NTIMACHO" is highly recommended (in all
                           humility). Treatment by hand is very
                           tedious and only for experts.
Standard Means......... Booting from a write-protected disk and
                           restoring all COM and EXE files from the
                           original disks is the only way.
----------------------- Acknowledgements------------------------------ 
Location............... Virus Test Center, University of Hamburg, FRG
Classification by...... Morton Swimmer
Documentation by....... Morton Swimmer
Date................... 1-Nov-1989
Information source..... "The Peter Norton Programmer's Guide to
                           the IBM PC" (1985), and the members of our
                           group.

.