VOID_POEM Virus (20-FEB-1993)
Entry...............: VOID_POEM Virus
Alias(es)...........: Poem Virus 
Virus Strain........: ---
Virus detected when.: 
              where.: South Africa
Classification......: Memory-resident Program (COM) infector, appending.
Length of Virus.....: 1.Length (Byte) on media:  1825 + 31 Bytes
                      2.Length (Byte) in memory: 1825 Bytes
--------------------- Preconditions ------------------------------------
Operating System(s).: MS-DOS
Version/Release.....: Version >=3.10
Computer model(s)...: IBM PCs and compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: --- 
Type of infection...: Self-Identification in memory: 
                         memw[0:1F0h] XOR memw[0:1F2h] = ACDCh
                      Self-Identification on disk:
                         file[last_byte-1] XOR D9h=file[last_byte]
Infection Trigger...: Execution of a COM program with 
                         580<=LengthCOM<=62464.
Storage media affected: FD/HD
Interrupts hooked...: INT 21h/4Bh, INT 21h/6Dh.
Damage..............: Permanent Damage: Poem (the same one) written 
                                        over LSN 1..1220 on drive C:
                      Transient Damage: Long Poem (very adolescent!) 
                                        displayed on screen; long text
                                        (not included here) encrypted.
Side-effect.........: PC may hang due to direct residency.
Damage Trigger......: Permanent Damage: IF Day=21 AND Month=12
                      Transient Damage: IF Day=21 AND Month<>12 
                                           AND counter=2112
Particularities.....: The poem printed by the virus states that it was 
                         written by "Marvin Giskard", the pseudonym of 
                         the person claiming to have written 
                         10_Past_3.748. The poem is dedicated to "T";
                         10_Past_3.789, a rework of .748, includes code 
                         to print the name "Therese".
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: 
--------------------- Acknowledgement ----------------------------------
Location............: 
Classification by...: Paul Ducklin 
Documentation by....: Paul Ducklin (CARObase)
                      Klaus Brunnstein (conversion to CVC format)
Date................: 1993-February-15
Information Source..: Reverse-engineering of virus

.