Techno Virus (20-FEB-1993)
Entry...............: Techno Virus 
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: December 1992
              where.: Pforzheim, Germany 
Classification......: Direct action, Program (COM) Infector, appending.
Length of Virus.....: 1.Length (Byte) on media:  1123-1138 Bytes
                      2.Length (Byte) in memory: ---
--------------------- Preconditions ------------------------------------
Operating System(s).: MS-DOS
Version/Release.....: Version >= 2.00
Computer model(s)...: IBM PCs and Compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: Infected Files contain two plain text strings 
                         near the end: "TECHNO",
                                       "Don't touch the keyboard". 
Type of infection...: Self-Identification on disk:
                         (FILE[0]=E9) and (FILE[A]=78) and (FILE[C]=79)
                      Appending file virus. The virus first tries to 
                         infect COMMAND.COM by checking for the COMSPEC 
                         entry in the environment and then does a 
                         find_first/next_loop on *.COM, which is 
                         limited by a timer to about 1.15 sec
                         (probably to hide the activity).
Infection Trigger...: Executing an infected file if Length of destination
                         file is 10<=FileLength<61439.
Storage media affected: COM files on HD/FD 
Interrupts hooked...: INT 1C and INT 24 are hooked; 
                      INT 10, INT 16 and INT 21 are used.
Damage..............: Permanent Damage: ---
                      Transient Damage: Displaying message, Techno music: 
                      Virus writes "TECHNO" all over the screen, while
                         playing techno music. If a key is touched this 
                         is intercepted and the string "Don't touch the 
                         keyboard" is written instead. Finally it 
                         displays a box in the middle spelling in big 
                         letters the word "TECHNO".
Damage Trigger......: Permanent damage: ---
                      Transient damage: Executing an infected file will 
                         trigger a random number renerator with a 0.25% 
                         probability of triggering the transient effects
                         (messages/music).
Particularities.....: Limits the infection process to 1.15 sec to reduce
                         the chance of being detected.
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: 1) For detection, search for "TECHNO" and 
                         "Don't touch the keyboard" in COM files.
                      2) For removal: delete or overwrite infected files.
--------------------- Acknowledgement ----------------------------------
Location............: Micro-BIT Virus Center, University of Karlsruhe
Classification by...: Christoph Fischer
Documentation by....: Christoph Fischer
Date................: 28-December-1992
Information Source..: Reverse-engineering of Virus

.