From: Victor_Smith@f2.n310.z9.virnet.bad.se (Victor Smith)
Newsgroups: comp.virus
Subject: New virus !!! (PC)
Date: 22 Sep 92 12:55:01 GMT

Hi Folks!

New virus has been discovered in The Netherlands!  First report has
been received from Andreas Reinicke from Hogeschool Eindhoven on
September 20th, 1992.

ATTENTION: Virus is quite dangerous and probably will spread very fast
due to sevral stealth tricks used in it.

Virus Name: Terminator-II (don't mix with Terminator described in
VSUMX) Detection: Gobbler-II v3.0 Disinfection: Gobbler-II v3.0+

Description:

 Aliases            :
 Length of virus    : 2294 bytes
 Classification     : Program (COM,EXE) infector; memory resident;
                      stealth;

 Easy Identification: File allocation errors shown by CHKDSK.
                      The amount of free memory is decreased by
                      2448 bytes.

 Type of Infection  : The virus appends itself to the end of an EXE or COM
                      file and changes the CS:IP in EXE header or places
                      JMP to virus code in COM files.
                      Only files bigger than 1388 bytes will be infected.
                      File with "SCAN" in any place of name will not be
                      infected.

 Infection Trigger  : Open and Load/Execute DOS services.

 Interrupts hooked  : 21h(Dos-Services); functions: 0Fh (Open_FCB),
                                                    11h (Find1st_FCB),
                                                    12h (FindNxt_FCB),
                                                    3dh (Open),
                                                    3eh (Close),
                                                    3fh (Read),
                                                    42h (Seek),
                                                    4eh (Find1st),
                                                    4fh (FindNxt),
                                                    4B00h (Load/Execute),
                                                    4B01h (Load),
                                                    6ch (Extended_Open);


 Memory location    : Top of system memory but below 640K boundary,
                      usually virus locates at 9f67:0000.
                      Virus allocates memory by decreasing size of the
                      last "Z" Memory Control Block by 2448 bytes.

 Self-Identification: 1) On media : Last two bytes of virus are equal to
                                    1000h, seconds value of FileTime set
                                    to 56.
                      2) In Memory: Function 4BFEh of DOS services
                                    reconstruct and executes program if
                                    virus is in memory, otherwise virus
                                    continues execution and install itself
                                    in memory.

 Damage(payload)    : First part:  Slows down speed of computer,
                                   mixing output to printer: case of
                                   every 16th character will be reversed
                                   and 0 will be changed to 9.
                      Second part: Displays string "TERMINATOR",
                                   overwrites CMOS, overwrites one side of
                                   all hard drives.

 Damage Trigger     : In two month after infection, if second bit of date is
                      non-zero first part of payload will be triggered,
                      otherwise if date bigger then date of infection on
                      two month plus ten days will be istalled the most
                      dangerous part.

 Comments           : Due to some new techniques virus is almost invisible
                      when it is active in memory. It has prevention from
                      "curing" by packing infected files, mostly stealth
                      viruses can be disinfected by such a trick, because
                      usually stealth virus returns clean file to system,
                      and file becomes clean during packing.

================================>CUT HERE<================

Regards,

VS