Alabama Virus (20-FEB-1993)
Entry...............: Alabama Virus
Alias(es)...........: ---
Virus Strain........: ---
Virus detected when.: October 1989
              where.: Israel
Classification......: Resident, appending EXE infector.
Length of Virus.....: 1) Length on media: 1408 bytes
--------------------- Preconditions -----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx and above
Computer model(s)...: IBM PC, XT, AT and compatibles
--------------------- Attributes --------------------------------------
Easy Identification.: ---
Self Identification.: File create/edit time contains 63 seconds.
                         First 4 bytes of memory are 0h.
Type of infection...: Appends itself to the executed file.
Infection Trigger...: Any INT 21h load/execute function-call.
Storage media affected: All files on each locations.
Interrupts hooked...: INT 21h function 4Bh (load and execute); INT 24h.
Damage..............: Permanent damage: ---
                      Transient damage: One hour after the start of an 
                         infected program, the following message will
                         be displayed: "SOFTWARE COPIES ARE PROHIBITED 
                         BY INTERNATIONAL LAW", 
                         "Box 1055 Tuscambia ALABAMA USA"
                         The message is encrypted by the NOT function.
Damage Trigger......: Permanent damage: ---
                      Transient damage: 1 hour after starting an 
                                        infected program.
Particularities.....: ---
Similarities........: ---
--------------------- Agents ------------------------------------------
Countermeasures.....: Skulasons F-PROT 2.06a, McAfee SCAN V99.
Standard means......: Reboot and delete infected files.
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University of Hamburg, Germany.
Classification by...: Michael Haack
Documentation by....: Michael Haack
Date................: 01-FEB-1993
Information Source..: Virus-code analysis

.