From: TYETISER@ssw02.ab.umd.edu (Tarkan Yetiser)
Newsgroups: comp.virus
Subject: Info on "Invol" virus (PC)
Date: 27 Aug 92 02:47:02 GMT


   Hello everyone,
   following is a preliminary analysis of the "Invol" virus:
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
Suggested Name: Involuntary
Location      : U.S.A.
Type          : Encryptive, resident EXE/SYS infector with damage trigger
                Program entry is modified to point to the virus decryption
                code appended at the end of the victim. File size will
                grow by 14xx bytes. The size change can be observed with
                a DIR command, no stealth attempt is made by the virus.

Interrupts    : 21h via direct access to IVT
hooked             Checks for AX = 4B00, LOAD/EXEC request

                Virus handler will always have 0014 as the offset
Scan string   : No simple scan string is available for EXE files due to the
                encryptive nature of the beast. In memory (INT 21h handler)
                and SYS files, you can check for:

                3d 00 4b 74 03 e9 45 02 50 53
                52 1e 06 b8 02 3d cd 21 73 03

Damage        : Overwrites the first ten sectors of the first FAT on C:
drive
and trigger     using INT 26h (absolute disk write).
condition       It triggers every month on the 14th day and displays the
                following message before doing damage:

                   "You have helped spread this virus
                   This has been a message from your friendly
                   neighborhood infection service.
                   Thank you for your involuntary cooperation."

                After the message is displayed, the mentioned area of the
                C: drive will be overwritten and the computer will hang.

Comments      : This virus uses a crude 16-bit XOR type encryption routine
                to evade identification. The encryption key is obtained
                from the BIOS timer (low word only). The decryption loop
                also contains a bunch of NOP instructions for confusion.
                The general routine used for encryption is fixed and
                the virus does not qualify for fully polymorphic.

                     LOOP_TOP:
                               ...
                     ad        lodsw
                               ...
                     33 c2     xor     AX, DX
                               ...
                     ab        stosw
                               ...
                     e2 ??     loop    LOOP_TOP
                     e9 ?? ??  jmp     VIRUS_ENTRY

                When it first activates, it will try to read the
                C:\CONFIG.SYS file and look for device drivers to infect.
                It checks EXE victims fo 'MZ' signature, not extension,
                therefore any program loaded via 4B00, and that has an MZ
                signature is infected.
                The virus avoids multiple infections as follows:
                   If the difference between the SS field and the SP field
                   in the EXE header is equal to 5Ch, then assumes already
                   infected; otherwise, infect now.
                File access during infection is via handle-oriented DOS
                functions. If the victim is write-protected, it will NOT
                be infected since the virus does not attempt to clear
                the file attribute if a request to OPEN for READ/WRITE
                fails.
                The message shown above occurs twice in the infected SYS
                victim. The virus seems to go after
                        device=?:\?ansi.sys
                in C:\CONFIG.SYS.

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Tarkan Yetiser
VDS Advanced Research Group               P.O. Box 9393
(410) 247-7117                            Baltimore, MD 21228
e-mail:  tyetiser@ssw02.ab.umd.edu