"Advent" Virus (15-Feb-1990)
Entry.................. "Advent" Virus
Alias(es).............. ---
Strain................. Syslock/Macho Virus Strain
Detected: when......... Autumn 1988
          where........ Federal Country of Rheinhessen, FR Germany
Classification......... Program Virus (Link virus)
Length of Virus........ 2761 - 2776 (dec) bytes appended on
                               paragraph boundary
------------------------ Preconditions-------------------------------- 
Operating System(s).... MS/PC-DOS
Version/Release........ 3.00 and upwards
Computer models........ All IBM PC compatibles.
-------------------------- Attributes---------------------------------
Easy identification.... Beginning on every "Advent" (the time period 
                             beginning at the 4th sunday before 
                             Christmas until Christmas eve), the 
                             virus displays after every "advent
                             sunday" one more lit candle in a wreath
                             of four, together with the string 
                             "Merry Christmas" and plays the melody
                             of the German Christmas song "Oh Tannen-
                             baum". By Christmas all four candles are
                             lit. This happens until the end of Decem-
                             ber, when an infected file is run.
Type of infection...... The virus infects both COM and EXE files.
                        EXE files: it checks the checksum in the EXE 
                             header for 7CB6h, in which case no in-
                             fection will occure. 
                        COM files: are checked by looking for the
                             string 39,28,46,03,03,01 (hex) at offset
                             10h. The virus is not RAM resident,
                             therefore it will only infect when the
                             host is run. It infects by searching
                             through the directories on the current
                             drive and randomly choosing files and
                             directories to infect or search. It will
                             not infect any other drive. It will infect
                             COMMAND.COM.
Infection trigger...... Virus will infect any time it is run.
Media affected......... All disks that are addressable using
                             standard DOS functions, as long as it is
                             the current drive.
Interrupts hooked...... ---
Damage................. Transient damage: displayed picture, melody
                             (see Easy Identification)
Damage trigger......... Every time the host is run.
Particularities........ The virus checks for the environment variable
                             "VIRUS=OFF", in which case it will not
                             infect. The virus encrypts itself using 
                             a variable key.
                        The virus will only do its transient damage
                             after 1-Nov-1988.
Similarities........... Macho/Syslock: much of the code is identical,
                             including the startup code. This means 
                             that Advent will be identified as Syslock
                             by many scanning programs.
                        Advent seems to be the precursor to Macho
                             and Syslock (though detected later).
---------------------------- Agents----------------------------------- 
Countermeasures........ Use the environment variable described
                             above as a first aid measure only. If your
                             COMMAND.COM in infected, that wont stop
                             the virus much. Resetting the date will
                             only stop the damage, not the infection.
                        Here's one of the few strings that can safely
                             be searched for:
                             50,51,56,BE,59,00,B9,26,08,90,D1,E9,8A,E1,
                             8A,C1,33,06,14,00,31,04,46,46,E2,F2,5E,59;
                             it should be noted, however, that this
                             string will also identify Syslock and
                             Macho. 
                        There is no scanning method that will tell
                             the 3 apart. "NTIADVEN" uses a checksum.
 - ditto - successful.. For proper treatment, my Anti-Virus "NTIADNEN"
                             is highly recommended (in all humility). 
                             Treatment by hand is very tedious and only
                             recommendable for experts.
Standard Means......... Booting from a write-protected disk and resto-
                             ring all COM and EXE files from the ori-
                             ginal disks.
----------------------- Acknowledgements------------------------------
Location............... Virus Test Center, University of Hamburg, FRG
Classification by...... Morton Swimmer
Documentation by....... Morton Swimmer
Date................... December 10, 1989
Information source..... "The Peter Norton Programmer's Guide to the
                             IBM PC" (1985), and members of our group.
                             Also thanks to V-COMM for producing
                             "Sourcer" and making my life easier.

.