Armagedon Virus (26-July-1992)
Entry...............: Armagedon Virus
Standard CARO Name..: Armagedon Virus
Alias(es)...........: Greek Virus
Virus Strain........: ---
Virus detected when.: Mai 1990
              where.: Greece
Classification......: Programm/Link (COM) virus
Length of Virus.....: 1079 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MSDOS
Version/Release.....: 
Computer model(s)...: IBM-PC, XT, AT and upwards, and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: Text in virus body: "Armagedon the GREEK"
Type of infection...: Infects COM files only (Int 21h function 4Bh)
                         by prepending the virus before COM file.
Infection Trigger...: Load and execute File by Subfuction 4Bh of Int21h
Storage media affected: diskettes, hard disk
Interrupts hooked...: Int 21h DOS-Services:
                         - function 4Bh changed for infection;
                         - function E0h, returns DADAh;
                         - function E1h, returns the Int21h-Segment;
                      Int08h Timer-Interrupt: Damage-routine added.
Damage..............: Virus sends a string to all 4 COM-ports. This
                         string advises any connected hayes-modem to 
                         drop the line and to dial "081<pause>141". 
                         In Greece, this would be the time-annouce-
                         ment in Iraklion. Any other device connected
                         to a COM-port would output the String 
                         "+++aTh0m0s7=35dp081,,,,141" 
Damage Trigger......: If time is between 05:00 and 06:00 hours (am)
Similarities........: --- 
--------------------- Agents -----------------------------------------
Counterm. successful: McAfee Scan, Skulason F-PROT, Solomon FindViru
Standard means......: Deleting the first 1079 Bytes will disinfect the 
                        Programm.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, germany
Classification by...: Matthias Jaenichen, VTC Hamburg
Documentation by....: Yuval Tal, Weizmann-Institute, Rehovot, Israel
Date................: June 26, 1990
Information Source..: Yuval Tal

.