Semtex Virus (31-Jan-1992)
Entry...............: Semtex Virus
Alias(es)...........: Screen Trasher Virus 
Virus Strain........: 
Virus detected when.: September 1991
              where.: Germany
Classification......: Program (appending) virus, resident
Length of Virus.....: 1,000 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 1.xx upward
Computer model(s)...: IBM - PC, XT, AT, upward and compatibles
--------------------- Attributes -------------------------------------
Direct Detection....: Every hour, the screen is overwritten by trash.
Easy Identification.: Infected files will contain the string:
                       "  S E M T E X  by Dusan Toman, CZECHOSLOVAKIA"
                       " (7)213-040 or (804)212-23  "
Type of infection...: All *.COM that are executed or opened will be 
                         infected if their length <= 61,000 Bytes.
                         COMMAND.COM will also be infected; there is 
                         explicit code in the virus that exploits 
                         the comspec.
Infection Trigger...: Any Load/Execute or Open of a *.COM file.
Infection targets:..: All *.COM files with length <= 61,000 Bytes.
Interrupts hooked...: INT 08 (hooked); INT 10, INT 21 (used);
                      INT 61 (occupied)
Damage..............: At an hourly intervall, virus will trash screen
                         contents by overwriting with garbage.
Damage Trigger......: A Counter that counts the timer tics.
Similarities........: ---
Particularities.....: 1) This virus does not intercept INT 24, so a 
                         write error will occur upon each infection 
                         attempt.
                      2) Windows 3.0 will not like what virus does 
                         to the memory allocation.
                      3) INT 61 usage will render the following pro-
                         ducts inoperative:
                            Atari Portfolio (system management)
                            HP 95LX System (system management)
                            JPI topspeed modula (procedure exit trap)
                            FTP PC/TCP (function calls)
                            Adaptec and Omti controller
                            Banyan Vines (network)
                            Sangoma CCIP (CCPOP3270)
--------------------- Agents -----------------------------------------
Countermeasures.....: 
- ditto - successful: 
Standard means......:
--------------------- Acknowledgement --------------------------------
Location............: Micro-BIT Virus Center, Univ Karlsruhe, Germany
Classification by...: Christoph Fischer
Documentation by....: Christoph Fischer
Date................: 31-January-1992

.