Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!caen!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: WEBER@SBU.UFRGS.ANRS.BR (Raul Fernando Weber) Newsgroups: comp.virus Subject: Stoned and Dark Avenger mutations (PC) Message-ID: <0002.9104171702.AA08284@ubu.cert.sei.cmu.edu> Date: 16 Apr 91 01:00:00 GMT Sender: Virus Discussion List Lines: 36 Approved: krvw@sei.cmu.edu Three slightly different versions of the Stoned virus were detected during the last months in Porto Alegre (Southern Brazil). The first version contains the string "Your PC is now Stoned! LEGALISE MARIJUANA!". In the second version this string now reads "Your PC is now Stoned! LEGALISEm disk or d". Curiously, the last part of the modified string seems to be derived from the original boot sector, where the string "Non-System disk or disk error" can be found at the same offset. I wonder if this can happen due to a failure at the propagation routine? The third version is quite different, and was first detected in a city near Porto Alegre. The string now reads "Collor, um tiro basta! Call John MacAFee? ". The first line is in Portuguese and means "Collor, one shoot is enough!", a protest against the economic plan of President Collor. There is another modification, however, probably to protect this mutation against virus scanners. Beginning at the offset 63, four bytes were changed from BE 04 00 57 to 57 BE 04 00. With this change, SCAN and CLEAN cannot detect the virus anymore. The program F-BOOT from the FPROT114 package, however, is still able to detect and remove the virus (Good work, Frisk!). Another virus that also appeared in the last weeks was Dark Avenger. The string "Eddie lives...somewhere in time!" can be detected at the beginning of the virus body, but the final string was modified to "This virus was created in Singapore (C) Copyright 1990-91 Data Maniac". Both SCAN/CLEAN and F-FCHK (from FPROT114) are able to detect and eliminate this virus. Raul F. Weber Institute of Informatic Federal University of Rio Grande do Sul Porto Alegre - RS Brazil e-mail: weber@sbu.ufrgs.anrs.br or weber%sbu.ufrgs.anrs.br@lbl.gov