Trivial Virus Strain (31-July-1993) Strain................ Trivial Virus Strain Classification........ All Trivial Viruses: Overwriting COM infectors, direct action; not memory-resident. Size of Viruses....... On media: various (see specific entries) ======================================== Virus Entry#1......... Trivial.Psycho = Trivial.Hastings Virus Detected: when........ --- where....... --- Size of virus......... Length: 200 bytes (overwriting) ------------------------------- Virus Entry#2......... Trivial.Hanger Virus Detected: when........ --- where....... --- Size of virus......... Length: 143 bytes (overwriting) ------------------------------- Virus Entry#3......... Trivial.Banana Virus Detected: when........ --- where....... --- Size of virus......... Length: 139 bytes (overwriting) ------------------------------- Virus Entry#5......... Trivial.50 Virus Detected: when........ --- where....... --- Size of virus......... Length: 50 bytes (overwriting) ------------------------------ Virus Entry#6......... Trivial.46 = DeathCow Virus Detected: when........ --- where....... --- Size of virus......... Length: 46 bytes (overwriting) Variant............... Trivial.42 Size of virus......... Length: 42 bytes (overwriting) ------------------------------ Virus Entry#7......... Trivial.45.A = Shortest Virus Detected: when........ --- where....... --- Clones................ Trivial.45.B virus, Trivial.45.C virus Size of virus......... Length: 45 bytes (overwriting) Variant............... Trivial.35 Virus Size of virus......... Length: 35 bytes (overwriting) ------------------------------ Virus Entry#8......... Trivial.44 Virus Detected: when........ --- where....... --- Length of virus....... Length: 44 bytes (overwriting) ------------------------------ Virus Entry#9......... Trivial.39 Virus Detected: when........ --- where....... --- Length of virus....... Length: 39 bytes (overwriting) Variant............... Trivial.38 Virus Length of virus....... Length: 38 bytes (overwriting) ------------------------------ Virus Entry#10........ Trivial.31.A Virus Detected: when........ --- where....... --- Clone................. Trivial.31.B = Miniscule Virus Size of virus/clone... Length: 31 bytes (overwriting) ------------------------------ Virus Entry#11........ Trivial.30.A Virus Detected: when........ --- where....... --- Clones................ Trivial.30.B, Trivial.30.C Virus Size of virus/clones.. Length: 30 bytes (overwriting) ------------------------------ Virus Entry#12........ Trivial.25 Virus Detected: when........ --- where....... --- Length of virus....... Length: 25 bytes (overwriting) Variant............... Trivial.26 Virus Length of virus....... Length: 26 bytes (overwriting) ---------------------- Preconditions --------------------------------- Operating System(s)... MS/PC-DOS 3.x upwards Computer models....... All IBM PC/AT compatibles ---------------------- Common Attributes of Strain Viruses ----------- Easy identification... Infected files will not run as they are over- written by the resp. virus; only virus code will be executed, and system will then crash. Type of infection..... Self-identification: none (just overwriting) COM files: not increased, unless infected file is shorter than virus. Files can only be infected when an infected host is started; first bytes of infected file (length depending on virus/variant) will be overwritten by virus. EXE files: no infection, unless virus infects with the *.* pattern. Infection trigger..... Any time an infected file is run, the viruses infects one or all .COM files in the current directory (see entries for details). Affected media........ Files on HardDisk or any FloppyDisk. Interrupts hooked..... --- Damage................ Permanent damage: infected file is overwritten. Damage trigger........ Execution of an infected file. Particularities....... The file date/time will be set to the date of the infection. Similarities.......... In stepwise reduction of size, Trivial viruses aim at achieving the shortest code suitable for infection. Though probably different authors worked on the viruses, this common goal is explicitly mentioned in some texts. While early version contain several texts, later versions contain essentially code suf- ficient to infect files by overwriting them; but texts may be deposited in infected files at remote locations. Every virus in Trivial strain infects one or all *.COM or *.C* or *.* files in the current directory, by overwriting the first bytes of the files with itself. If the file to be infected is smaller than the resp. virus, the file size will grow to the virus' size. The wildcard pattern *.* includes the files .COM .EXE .OVL .SYS .DOC .TXT etc. ---------------------- Special Attributes of Trivial.Hastings ---------- Virus name............ Trivial.Psycho or Trivial.Hastings Size.................. 200 bytes Type of infection..... Infects the 1st .COM file in current directory by overwriting it. Easy identification... Texts found in virus at offset 40dez '*.COM by' (encrypted name deleted) 'AKA Nick Haflinger...' 'Zopy me I want' to travel' 'I can now program in assembler' 'This program was written in the town' 'of Hastings hehehehe!' ---------------------- Special Attributes of Trivial.Hanger ------------ Virus name............ Trivial.Hanger Virus Size.................. 143 bytes Type of infection..... Infects all *.C* files (*.COM, but also *.C) in current directory by overwriting them. Easy detection........ Infected files contain (unencrypted) message (see Transient damage) at offset 59dez. Damage................ Permanent damage: Overwriting infected files. Transient damage: After infection, virus displays the message: 'System Hanger! Enjoy! ' 'Note: Your system is now hanged.' 'Press Reset to continue.' Then systems may hang (HLT instruction) ---------------------- Special Attributes of Trivial.Banana ------------ Virus name............ Trivial.Banana Virus Size.................. 139 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. Easy identification... The following text is found in infected files at offset 80dez: 'BANANA, coded by Morbid Angel' '-92 in Stockholm/Sweden*.COM' Particularities....... Upon infection, file-attribute, time and date are saved and correctly restored. ---------------------- Special Attributes of Trivial.50 --------------- Virus name............ Trivial.50 Virus Size.................. 50 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. ---------------------- Special Attributes of Trivial.46 ---------------- Virus name............ Trivial.46 = DeathCow Virus Size.................. 46 bytes Type of infection..... Infects all *.COM files by overwriting the,. Variants.............. Optimized version is Trivial.42, Size.................. 42 bytes ---------------------- Special Attributes of Trivial.45 ---------------- Virus name............ Trivial.45.A = Shortest Virus Size.................. 45 bytes Type of infection..... Infects all *.COM files by overwriting them. Clones................ Trivial.45.B and Trivial.45.C (same size) Variants.............. Trivial.35 Virus Size.................. 35 bytes ---------------------- Special Attributes of Trivial.44 ---------------- Virus name............ Trivial.44 Virus Size.................. 44 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them ---------------------- Special Attributes of Trivial.39 ---------------- Virus name............ Trivial.39 Virus Size.................. 39 bytes Type of infection..... Infects all *.COM files in current directory by overwriting them. Variants.............. Trivial.38 Virus Size.................. 38 bytes Remark................ A slightly optimized version of Trivial.39 Virus ---------------------- Special Attributes of Trivial.35 ---------------- Virus name............ Trivial.35 Virus Size.................. 35 bytes Type of infection..... Infects one file with pattern *.C* by overwriting Remark................ A significantly optimized version of Trivial.45 ---------------------- Special Attributes of Trivial.31.A -------------- Virus name............ Trivial.31.A Virus Size.................. 31 bytes Type of infection..... Infects one file with pattern *.C* by overwriting ---------------------- Special Attributes of Trivial.31.B -------------- Virus name............ Trivial.31.B = Miniscule Virus Size.................. 31 bytes Type of infection..... Infects one file with pattern *.* by overwriting Easy identification... The following text is found in infected files ---------------------- Special Attributes of Trivial.30.A/B/C ---------- Virus name............ Trivial.30.A Virus Size.................. 30 bytes Type of infection..... Infects one file with pattern *.* by overwriting Variant#1............. Trivial.30.B Particularities....... Trivial.30.B overwrites 256 bytes of a file Remark................ Uses two different opcodes for same purpose Variant#2............. Trivial.30.C Virus Remark................ Some opcodes swapped, but 98% same code Particularities....... Trivial.30.C overwrites 30 bytes of a file ---------------------- Special Attributes of Trivial.25 --------------- Virus name............ Trivial.25 Virus Size.................. 25 bytes (or longer); infected file size will vary, due to some optimization in virus code, in the range of overwritten bytes 25 <= size <= 33049. Type of infection..... Infects one .COM file by overwriting Particularities....... Virus only works under specific conditions. Variants.............. Trivial.26 Virus Size.................. 26 bytes Type of infection..... Infects one *.* file Particularities....... As Trivial.25, this virus also works only under specific conditions ---------------------- Agents ----------------------------------------- Countermeasures....... Standard Means........ 1) Notice file length and file date/time. 2) Use ReadOnly attribute. 3) Infected files can only be disinfected by replacing them with the original files. ---------------------- Acknowledgements -------------------------------- Location.............. Virus Test Center, University Hamburg, Germany Classification by..... Stefan Tode Documentation by...... Stefan Tode Date.................. 31-July-1993 (Update of Feb-93 entry) Information source.... --- .