"Thursday 12" Virus (15-July-1991)
Entry...............: Thursday-12 Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: June 27, 1991
              where.: Tornado Bulletin Board (TECS), Hamburg
Classification......: Memory-resident Program Infector
                      Simple self-encryption
Length of Virus.....: EXE-files: 2270 Bytes; COM-Files: 2168 Bytes
                      Memory:    2161 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: INT 21 Vector is hooked to adress xxxx:026d;
                      EXE-files start at adress xxxx:100 with jump 
                         to 106 and call to 10c (at 106);
                      COM-files start with jump, at the target of 
                         this jump, identical code will be found.
                      The virus' text (see: transient damage) can be 
                         found near the end of memory, 52dh bytes
                         behind the INT 21 target adress.
Scanner Signature...: String 83 f9 00 74 09 51 56 30 24 46 is con-
                         tained near end of EXE and COM files.
Type of infection...: The virus appends itself at the end of EXE and 
                         COM files. It will not infect programs con-
                         taining any of the following strings in their
                         name: SCAN, CLEAN, VIR, ARJ, FLU or COMMAND.         
Infection Trigger...: Execution of an infected program.
Storage media affected: Files can be infected on all medias.
Interrupts hooked...: INT 21, functions 0f,3d (both open a file), 
                                        4b (load/execute)
                                        6c (extended open and create (dos 4.0))
                              are used to infect a file.
Damage..............: Permanent damage: ---
                      Transient damage: The virus draws a litte box, 
                         containing the following text:
                         "VirCheck V1.2 (C) 1991
                         Be aware of those worms out there, violating
                         your machine on Friday 13th - it's tomorrow!
                         Special thanks to Ross M. Greenberg
                         Patricia M. Hoffmann and John McAfee
                         Press any key to continue..."
                      The box disappears after pressing any key and 
                      system continues working, completely unaffacted.
                      No side effects have been observed, although 
                         heavy damage was reported, when running this 
                         virus with a hard-disk realtime-packer.
Damage Trigger......: The text appears only on Thursday 12th, after 
                         execution of 4 programs that were already 
                         infected, if the virus is in memory.
Particularities.....: The virus was found on a public domain PAC-MAN 
                         game (CD-MAN), which could be downloaded from 
                         the Tornado BBS, Hamburg. The infected program
                         was downloaded 19 times before detection of 
                         contamination; at this time (1st generation),
                         it was also reported in Kiel (100 km north
                         of Hamburg). After report, infected program 
                         was deleted from BBS. 
                         (It is known, who actually put the program 
                         onto BBS, and we try to get more information
                         where the virus actualy comes from)
Similarities........: ---
--------------------- Agents ------------------------------------------
Countermeasures.....: (no contemporary scanner finds the virus)
Countermeasures successful: ANTITH12 of Toralv Dirro finds and
                          eradicates this virus.
Standard means......: Delete infected EXE&COM files, copy uninfected 
                         versions from original write-protected disk.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany 
Classification by...: Toralv Dirro, Stefan Tode
Documentation by....: Toralv Dirro
Date................: 15-July-1991
Information Source..: (original virus analysis)

.