From: Ari.Hypponen@hut.fi (Ari Hypp|nen)
Newsgroups: comp.virus
Subject: A virus infecting Windows excutables found (Windows) (PC)
Date: 28 Sep 92 01:23:12 GMT

A new virus capable of infecting Windows executables has been 
found. The new virus uses direct action methods and does not 
infect DOS EXE files. It seems that this new virus, called 
Win_Vir.14, is the first virus to successfully spread under 
the Windows operating environment using the native NE format.
 
Data Fellows Ltd of Helsinki, Finland obtained a sample from 
Sweden. Here are some preliminary research notes about the 
virus:
 
_____
 
Apparently the first virus to infect Windows executables 
has been found. The virus activates when an infected file is
run and copies its code to other Windows EXE files. These 
notes are from a preliminary analysis and may contain errors.
 
- - The sample was obtained 26.9.1992 from Goteborg, Sweden. The
  original source is not known.
- - The sample contains a parasitic, direct-action virus, which infects 
  EXE files of the New Executable format, i.e. Windows executables.
- - DOS EXE files are not infected.
- - The code of the virus contains two strings:
  'Virus_for_Windows  v1.4' and 'MK92'
- - Final name for this virus has not yet been decided. The 
  suggested name is Win_Vir.14.
- - Win_Vir.14 is not detectable by any of the current virus-scanners
  in their normal scanning modes.
 
The infection process is as follows:
 
  1. Virus gains control when an infected program is run.
  2. The virus searches for a suitable victim file (*.EXE) 
     from the current directory using DOS INT 21, AX=4E, 4F 
     services.
  3. If no files are found, program is terminated with INT 21, 
     AX=4C00. The host program never gets executed.
  4. The victim file is opened and the date and time are memorized.
  5. MZ and NE (New Executable) signatures are checked. Relocation
     table offset is checked to be below 40h.
  6. Various items of the NE header are checked to match an 
     infection criteria.
  7. Virus code is inserted into the middle of the victim.
  8. The original code is moved to the end of the program.
  9. The NE header's CS:IP address is changed to point to the start
     of the virus.                                     
 10. The virus removes its code from the original host 
     restoring it to the exact state it was in before infection.
 11. Virus terminates.
                        
Notes:
 
- - While terminating itself the virus also terminates the host 
  program, so when the user starts an infected file it will 
  simply fail to do anything. This will usually look like a 
  missed double-click.
- - If the same file is started again, it will run normally, as 
  the virus has already removed itself from the file at that time.
- - Infected files grow by 854 (356h) bytes.
- - The virus conserves date attributes.
- - The virus is not crypted or protected in any way.
- - The code does not seem to contain any triggering routines.
- - If the executable includes attributes for allowing relocation of
  segments, this attribute is removed from the infected segment.
- - The virus carries the name of the host program and also the name of
  the program that infected it.
- - The virus might to be able to infect OS/2 files also. This 
  has not been tested.
 
 
A temporary search string to find the infected files follows 
(in F-PROT USER.DEF format):
 
 -------- cut here and insert into USER.DEF ---------
E Win_Vir.14
813C4E457516817C0C0203750F807C3204750981
 --------------------- cut here ---------------------
 
Remember to use the /USER switch if using F-PROT in command 
line mode.
 
For more information, contact
 
                    Data Fellows Ltd
                    F-PROT Support
                    Mikko Hypponen
                    Wavulinintie 10
                    SF-00210 Helsinki
                    Finland
 
                    Internet: Mikko.Hypponen@compart.fi
                    Phone:    +358-0-692 3622
                    Mobile:   +358-49-648 180
                    Fax:      +358-0-670 156
 
- --
Ari Hypp|nen, Ari.Hypponen@hut.fi