Vacsina (1,2) Virus (15-Feb-1990)
Entry...............: "Vacsina Virus" (#1/#2)
Alias(es)...........:
Virus Strain........:
Virus detected when.: August 1989
              where.: University of Cologne, FRG
Classification......: Link-virus (extending), RAM- resident
Length of Virus.....: .COM files: program length increases by
                                  1206-1221 bytes
                      .EXE files: program length increases by
                                  132 bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: 1. Typical texts in Virus body (readable
                           with HexDump-facilities): "VACSINA" in 
                           data area of the virus.
                      2. The length of an infected file is increased.
                      2. The date/time of the last program modification
                         is different between an infected program and
                         its original version.
Type of infection...: System: infected if the segment:offset of INT31h
                           points to 0539h:7fxxh.
                      .Com files: with a program length of 1207-62866
                           bytes will be infected if the first instruc-
                           tion is a JMP_DISP_16 (Opcode E9) and the 
                           program length increases by 1206-1221 bytes.
                           The last 4 bytes are 0F4h,07Ah,005h,000h 
                           (identification); therefore, a .COM file
                            will not be infected more than once.
                      .EXE files: with a program length up to 64946 
                           bytes will not be infected, but converted 
                           in a COM-format and the program length 
                           increases by 132 bytes. The virus adds code
                           to the EXE-file that is able to relocate 
                           the file while loading it. If a converted
                           EXE-file is started again in an infected 
                           system, it will be infected like a COM-file.
Infection Trigger...: Programs are infected when they are run (using 
                           the function Load/Execute of Ms-Dos).
Interrupts hooked...: INT21h, INT24h (only while infecting a file).
                      INT31 (identification that system is infected)
Damage..............: Transient damage: every time a file is infected,
                          the loudspeaker will beep.
Damage Trigger......: ---
Particularities.....: The date/time of the last program modification
                          will not be restored.
--------------------- Agents -----------------------------------------
Countermeasures.....: Category 3: ANTIVACS.EXE (VTC Hamburg)
- ditto - successful: ANTIVACS.EXE is an antivirus that specifically
                           looks for the VACSINA virus and, if re-
                           quested, will restore the file.
Standard means......: ---
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Michael Reinschmiedt
Documentation by....: Michael Reinschmiedt
Date................: January 3, 1990

.