Runtime Virus (31-July-1993)
Entry...............: Runtime Virus
Alias(es)...........: Runtime-err412 Virus
Virus Strain........: ---
Virus detected when.: July 1993
              where.: USA
Classification......: File virus (COM, COMMAND.COM infector)
Length of Virus.....: 1.Length (Byte) on media: 365 Bytes
                      2.Length (Byte) in RAM:    0 (not memory resident)
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS 
Version/Release.....: MSDOS >= 3.0
Computer model(s)...: IBM PCs and Compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: Text in virus code: "Runtime error 412" 
Type of infection...: File infection: virus infects COM files, including 
                         COMMAND.COM. To hide itself against detection
                         (stealth), it restores original time and date
                         stamps to files after infection.
                      Self-Identification in files: code intends to check
                          for initial NEAR CALL (0eh), doesnot work.
                      System infection: not memory resident.
                      Self-Identification in memory: ---
Infection Trigger...: Upon execution of an infected file
Storage media affected: Disk and diskette
Interrupts hooked...: None
Damage..............: Permanent Damage: no intended permanent damage.
                         Side effect: Uncontrolled file growth due to 
                         multiple infections.
                      Transient Damage: 
                         1) Hangs system occasionally on trigger 
                            conditions.
                         2) Displays message "Runtime error 412" 
                            followed by possible garbage.
Damage Trigger......: Permanent Damage: ---
                      Transient Damage:
                         1) On Fridays before 11:00 AM 
                            if clock @ 40:06Ch >0b0h.
                         2) Execution of infected file.
Particularities.....: Virus cannot infect read-only files.
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: At publication date, virus was not detected
                          by tested scanners (VIRx,McAfee's Scan,F-Prot, 
                          IBM anti-virus, and TBscan602).
Standard means......: Delete infected files and replace with clean ones.
--------------------- Acknowledgement ----------------------------------
Location............: Stiller Research, Tallahassee Florida
Classification by...: Wolfgang Stiller
Documentation by....: Wolfgang Stiller (CAROBase entry)
                      Klaus Brunnstein (Virus Catalog entry)
Date................: 6-July-1993
Information Source..: Reverse analysis of virus code

.