Peter Virus (31-July-1993)
Entry...............: Peter Virus 
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: May 1993
              where.: Japan
Classification......: System virus (MBR,FBR infector)
Length of Virus.....: 1.Length (Byte) on media: 5 sectors
                      2.Length (Byte) in RAM:   4 kBytes
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS
Version/Release.....: 
Computer model(s)...: IBM PCs and Compatibles: models > 80286, CMOS
--------------------- Attributes ---------------------------------------
Easy Identification.: 
Type of infection...: File infection: ---
                      Self-Identification in files: ---
                      System infection: When booting from an infected
                         disk or diskette, virus installs itself in 
                         hi-memory. On media, virus code is 5 sectors
                         long, stored at at 0/0/2 (disk), an at 50/0/2 
                         (floppy, only if sectors/track is at least 15)
                      Self-Identification on disks:
                         MBR [0x1FD] == 0xBB, FBR [0x1FD] == 0x11
                      Self-Identification in memory: ---
Infection Trigger...: MBR: (Boot) & (MBR[0x1FD]!=0xBB)
                      FBR: (INT13) & (AX==02 | AX==03) &
                           (FBR[0x1FD]!=11) & (FBR[0x18]>=0x0F)
                          That is, when booting from an infected floppy,
                          virus infects hard disk unless its mark is 
                          already there, and when using a floppy in A: 
                          it gets infected unless the mark is there, 
                          or it has less than 15 sectors/track.
Storage media affected: Hard disk, floppy disks
Interrupts hooked...: INT 13/02, 13/03
Damage..............: Permanent Damage: If user answers any of the 
                         questions (see Transient Damage) incorrectly, 
                         virus returns without restoring the garbled 
                         part of hard disk.  If user answers correctly, 
                         virus restores garbled part of hard disk and 
                         boots normally.  (Not actually tested)
                      Transient Damage: Upon trigger conditions (see
                         Transient Damage Trigger), virus displays a
                         message (see below), garbles part of hard disk 
                         by XORing with hex 78, and asks four questions
                         about pop music.
                         Message, questions and replies (excrypted):
                            "Good morning,EVERYbody,I am PETER II
                             Do not turn off the power, or you will 
                             lost all of the data in Hardisk!!!
                             WAIT for 1 MINUTES,please...
                             Ok.If you give the right answer to the 
                             following questions,I will save your HD:
                             A. Who has sung the song called 
                                "I`ll be there" ?
                                1.Mariah Carey  2.The Escape Club  
                                3.The Jackson five  4.All  (1-4):
                             B. What is Phil Collins ?
                                1.A singer  2.A drummer  3.A producer  
                                4.Above all   (1-4):
                             C. Who has the MOST TOP 10 singles
                                in 1980`s ?
                                1.Michael Jackson  2.Phil Collins 
                                (featuring Genesis)
                                3.Madonna  4.Whitney Houston   (1-4):
                             CONGRATULATIONS !!! YOU successfully pass 
                                the quiz!
                             AND NOW RECOVERING YOUR HARDISK ......
                             Sorry!Go to Hell.Clousy man!"
Damage Trigger......: Permanent Damage: If user answers a question 
                         in the quiz wrong.
                      Transient Damage: If CMOS clock bytes 7 and 8 
                         contain 27 and 2.
Particularities.....: 1) Correct answers are: 4,4,2 (at least in the 
                         virus author's opinion)
                      2) Coding style (and English) is very odd and 
                         self-taught-looking; e.g. Virus author seems
                         not to know about direct addressing modes.
                      3) Limitations: Virus executes only if CPU >= 286 
                         (uvirus ses PUSHA and POPA), CMOS (for date
                         for payload)
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: 
--------------------- Acknowledgement ----------------------------------
Location............: IBM High Integrity Computing Lab, Hawthorne N.Y.
Classification by...: David Chess, HICL
Documentation by....: David Chess (CAROBase entry)
                      Klaus Brunnstein, VTC Hamburg (Virus Catalog)
Date................: 24-May-1993, 1993
Information Source..: Reverse analysis of virus code

.