Qrry Virus (31-July-1993)
Entry...............: Qrry Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: March 1993
              where.: USA
Classification......: System virus (MBR, FBR infector), memory resident
Length of Virus.....: 1.Length (Byte) on media:  1 Sector
                      2.Length (Byte) in RAM:    1 kByte
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS 
Version/Release.....: 
Computer model(s)...: IBM PCs and Compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: Test if bootrec[0]==EBh & bootrec[0170h]==ABCDh
Type of infection...: File infection: ---
                      Self-Identification in files: ---
                      System infection: Virus code stored at 27h/01h/09h.
                         Upon booting from an infected disk, virus makes 
                         itself memory resident (in hi-memory).
                      Self-Identification in memory: ---
                      Self-Identification on disk: 
                          bootrec[0]==EBh & bootrec[0170h]==ABCDh
Infection Trigger...: If given values in INT 13 registers are found.
Storage media affected: Hard disk, floppy disks 
Interrupts hooked...: INT 13/0201
Damage..............: Permanent Damage: overwrites the first 9 sectors 
                         of the first 3 tracks on any disk or diskette 
                         head that's read from.
                      Transient Damage: --- 
Damage Trigger......: Permanent Damage: All days in December:
                         Real_Time_Clock_Month == 12
                      Transient Damage: ---
Particularities.....: Name "QRRY" is taken from some ASCII characters 
                         that happens to appear in virus code; no other
                         obvious characteristic for naming.
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......:  
--------------------- Acknowledgement ----------------------------------
Location............: IBM High Integrity Computing Lab, Hawthorne N.Y.
Classification by...: David Chess, HICL
Documentation by....: David Chess (CAROBase entry)
                      Klaus Brunnstein, VTC Hamburg (Virus Catalog)
Date................: March 8, 1993
Information Source..: Reverse analysis of virus code

.