Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!ames!elroy.jpl.nasa.gov!usc!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: davidf@CS.HW.AC.UK (David.J.Ferbrache) Newsgroups: comp.virus Subject: Saratoga and Icelandic viruses (PC) Message-ID: <0001.8907271315.AA12859@ge.sei.cmu.edu> Date: 27 Jul 89 09:55:50 GMT Sender: Virus Discussion List Lines: 42 Approved: krvw@sei.cmu.edu Message forwarded for BCVRC, I have recently received copies of two viruses, referred to as the "Saratoga" virus and the "Icelandic" virus. They are clearly minor variants of the same program, and the evidence is that the Saratoga virus was observed and collected in California some months previous to the appearance of the Icelandic. For this reason I shall refer to the latter as the Icelandic variant of the Saratoga virus. The actual differences are three: 1. The Icelandic variant has five extra lines of code which check the segment of the Int 13H vector. The virus is only installed if this segment is that of the BIOS (0F000H) or of DOS (0700H). This is obviously an ill-considered addition as, if this vector had not been taken over by DOS, this test would preclude any machine with a hard disk (the target of the virus). 2. The four-byte signature on the Saratoga virus is "PooT". This has been changed to the hex string 18 44 19 5F in the variant. 3. The infection count has been changed from one in two to one in ten in the variant. The procedure of making the host program an exact number of paragraphs (divisible by sixteen) before infection is not unique to this virus, it is a normal and necessary characteristic of any virus which infects EXE files. The infective length of the virus is 642 bytes, or 656 for the variant, but this length will appear to vary because of the above-mentioned rounding up of the length of the host program. Although I can find no errors in the code to explain it, I have not been able to induce either version to mark a cluster as bad on a 32 meg hard disk. Joe Hirst British Computer Virus Research Centre 12 Guildford Street Brighton East Sussex BN1 3LS England Telephone: Domestic 0273-26105 International +44-273-26105