Bouncing-Ball (Serptember 10, 1989)
Entry.................. Bouncing-Ball Virus
Alias(es).............. Italian = Ping Pong = Turin-Virus
Strain................. ---
Detected: when......... March 1988
          where........ University of Turin, Italy
Classification......... Bootsector/resident; loads to high-memory.
Length of Virus........ Length on disk: 2 Sectors of 512 Bytes
                           length plus original bootsector  = 3 Sectors. 
                        Length in RAM: 1024 Byte.
----------------------- Preconditions----------------------------------- 
Operating System(s).... MS-DOS
Version/Release........ ---
Computer models........ IBM-PC, XT, AT and compatible
----------------------- Attributes--------------------------------------
Easy identification.... 1.The bootsector contains at the offset
                          01FCh the word 1357h. This is how the
                          virus identifies itself.
                        2.Enter TIME 0, then immediately press any 
                          key and Enter; if the virus is present, the
                          bouncing dot will be triggered
                          (->Damage Trigger).
Type of infection...... Infects disk media as follows:
                        1. Determines whether infection is possible
                        2. Secures original bootsector
                        3. Copy the virus's first sector to the
                           bootsector
                        4. Copy the virus's second sector to the
                           first free cluster
                        5. Mark the cluster as bad
                        6. Load and jump to the original boot sector.
Infection trigger...... Every disk that is _read_ using the BIOS
                        function 13h will be infected. (As all read
                        and write operations use this interrupt,
                        any disk operation can lead to infection.)
Media affected......... Infects floppy disks as well as hard disks.
                        The media must fulfill the following criteria:
                        1. 512 bytes per sector (standard)
                        2. There must one free cluster
                        3. A cluster must be at least 2 sectors long.
                        For hard disks: The master boot block (which
                        contains disk and partition data) must conform 
                        to the standard.
Interrupts hooked...... BIOS Int 13h
Damage................. Permanent: the boot block is overwritten
                        Transient: A small rhombus (IBM character set:
                                   07h) moves like a "bouncing ball" (or 
                                   ping pong ball) over the screen.
Damage trigger......... Triggered randomly after a disk access within
                           1 second after the system clock reaches a
                           multiple of 30 minutes (e.g, 00:00, 00:30, 
                           01:00, etc.).
Particularities........ 1. The virus loads itself to high memory and
                           reduces the memory available to the operating
                           system by modifying a BIOS variable.
                        2. The virus cannot always tell if the hard disk
                           is non-standard, and terminates. Should the 
                           virus try to infect a non-standard disk, data 
                           may be destroyed on the disk.
Similarities........... ---
-------------------------- Agents---------------------------------------
Countermeasures........ Infected system disks can be cleaned by using
                        the DOS program "SYS.COM". (You must boot from
                        a clean disk.) The "bad" cluster will, however, 
                        remain.
Countermeasures successful ---
Standard Means......... The DOS program "CHKDSK.COM" shows clusters,
                        that contain bad sectors.
----------------------- Acknowledgements -------------------------------
Location............... Virus Test Center, University Hamburg, FRG
Classification by...... Michael Reinschmiedt
Documentation by....... Michael Reinschmiedt
Date................... July 30, 1989
Updated by............. Y.Radai, Hebrew University, August 31, 1989
Information source..... ---

.