davidf@CS.HW.AC.UK (David.J.Ferbrache) (07/27/89)
Message forwarded for BCVRC,
I have recently received copies of two viruses, referred to as the
"Saratoga" virus and the "Icelandic" virus. They are clearly minor
variants of the same program, and the evidence is that the Saratoga virus
was observed and collected in California some months previous to the
appearance of the Icelandic. For this reason I shall refer to the latter
as the Icelandic variant of the Saratoga virus.
The actual differences are three:
1. The Icelandic variant has five extra lines of code which check
the segment of the Int 13H vector. The virus is only installed
if this segment is that of the BIOS (0F000H) or of DOS (0700H).
This is obviously an ill-considered addition as, if this vector
had not been taken over by DOS, this test would preclude any
machine with a hard disk (the target of the virus).
2. The four-byte signature on the Saratoga virus is "PooT". This
has been changed to the hex string 18 44 19 5F in the variant.
3. The infection count has been changed from one in two to one in
ten in the variant.
The procedure of making the host program an exact number of paragraphs
(divisible by sixteen) before infection is not unique to this virus, it is
a normal and necessary characteristic of any virus which infects EXE files.
The infective length of the virus is 642 bytes, or 656 for the variant, but
this length will appear to vary because of the above-mentioned rounding up
of the length of the host program.
Although I can find no errors in the code to explain it, I have not been
able to induce either version to mark a cluster as bad on a 32 meg hard
disk.
Joe Hirst
British Computer Virus Research Centre
12 Guildford Street Brighton
East Sussex BN1 3LS England
Telephone: Domestic 0273-26105
International +44-273-26105