"982" Virus (15-July-1991)
Entry...............: 982 Virus
Alias(es)...........: (Klaeren Virus; see: Particularities/Remark)
Virus Strain........: ---
Virus detected when.: March 1991
              where.: University of Tuebingen (South-West Germany)
Classification......: Resident File Infector
Length of Virus.....: 972-982 Bytes (file)
--------------------- Preconditions -----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes --------------------------------------
Easy Identification.: ---
Scanner Signature...: at end of infected file: 9C FF 1E EB 04 53 51 E8
                       00 00 5B 81 EB AF 03 B9 A5 03 80 37 ?? 43 E2 FA
                       59 5B 3B C1 C3 32 C0 CF 4D 5A
Type of infection...: Program Infector: virus appends itself at end of
                         .COM and .EXE files, enlarging the filesize
                         between 972 and 982 bytes.
Infection Trigger...:   
Interrupts hooked...:  
Damage..............: On trigger condition (in May, each year), 
                         transient damage is produced.
                      Transient Damage: On trigger condition (May),
                         virus writes several screen pages with
                         text "Klaeren, Ha^s, Ha^s!" 
                         (^s = scharfes s, ascii 225; Ha^s=hate),
                         and subsequently erases CMOS RAM thus
                         making disks etc. inaccessible.
                      Permanent Damage: beyond consequences of
                         lost access to devices (e.g. lost data),
                         no permanent damage has been observed. 
                      Side Effects: ???
Damage Trigger......: Damage occurs when month=5 (May), each year
Particularities.....: Virus was found in a publicly accessible PC at
                         University of Tuebingen (South-West Germany).
                         The "ha^s" (=hate) message adresses Professor
                         Klaeren (University of Tuebingen).
                      Remark: some antiviruses identify this virus
                         as "Klaeren"; though this name is observed
                         when the virus action is triggered, names
                         of innocent victims should not be used. In-
                         stead, the length-oriented name "982" is
                         preferred as main name.
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: Delete infected EXE&COM files, copy uninfected
                         versions from original write-protected disk.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Klaus Brunnstein 
Documentation by....: Klaus Brunnstein 
Date................: 15-July-1991
Information source..: (original virus analysis)

.