From: weber@inf.ufrgs.br (Raul Fernando Weber)
Newsgroups: comp.virus
Subject: Information about Brasil virus (PC)
Date: 9 Oct 92 23:09:42 GMT

I have obtained a copy of the "Brasil virus" and partially
disassembled it.  Here follows the results:

This analysis is based upon the virus sectors found in a 360k
diskette, forwarded by Joseph Max Cohenca <mcohenca@uspif.if.usp.br>,
from University of Sao Paulo, Brazil.

1. The virus is not detected by any anti-virus software available now
(5th October 1992). F-Prot 2.05 doesn't detect it, neither in "secure
mode" nor in "quick mode" nor in "heuristic mode". Scan v95b detects a
"Generic Boot Infector", but this is just a warning saying that SCAN
did not discover the normal DOS boot code in the disk.

2. The virus is a bootstrap virus, and seems to be a new one; either
it is an original Brazilian virus, or it is a very modified copy from
some existing virus (like Stoned or Michelangelo).

3. The virus occupies three sectors of a disk. The first sector, that
substitutes the boot in diskettes, or the master boot in hard disks,
contains the initial activation code of the virus, which is executed
when the machine is powered up or rebooted. The second sector
contains the virus code that becomes memory resident, and that is
responsible for propagating the virus. In the third sector the virus
stores the original boot sector.

4. In hard disks the virus uses for his three sectors the sectors 1, 2
and 3 of cylinder zero, head zero. To eliminate this virus, sector 3
(the original master boot) should to be copied back into sector 1.

5. In 360k diskettes the virus uses DOS sectors 0, 10 and 11 (this
means sector 1, cyl. 0, track 0 (boot), sec 2 cyl 0 tr. 1 (sector 10
and sect 3 cyl 0 tr. 1 (sector 11)). Sectors 10 and 11 are the end
sectors of the root directory, and the virus may overwrite directory
information during the infection process. To eliminate the virus
sector 11 into should be copied back into sector 0.

6. The virus handles correctly other diskette types (720k, 1.2M and
1.44M), hiding his three sector always in the boot sector and in the
last two directory sectors.

7. The virus test his own presence through the addresses hex 01A8 and
01A9 of the boot sector. If these two bytes are CF CF, the virus
assumes it already infected the disk. If not, it then proceeds to
infect the disk.

8. The virus intercepts only interrupt 13H (Bios Disk services).

9. The virus uses stealth techniques to avoid his detection. Any read
access to the boot sector is redirected to the sector where the virus
stored the original boot sector.

10. During his attack, the virus writes "Brasil virus!" at the current
cursor position at screen. This text ("Brasil virus!") is stored
scrambled in the second virus sector.

11. The virus infects only diskettes in drive A:., during read
 operations. A single "Dir" command is enough to infect a diskette.

12. In order to trigger his attack, the virus sets a counter when it
infects a hard disk. This counter is decremented after each
 hour that the computer is in operation.  After 120 hours of
effective use, the virus writes his message ("Brasil virus!"),
writes random data in the first 50 cylinders of the hard disk
and the "freezes" the computer. Obs: This "trigger routine"
 needs further investigation. I haven't disassembled it completely.


A specific program to detect and eliminate the "Brasil virus" was
written in the Informatics Institute of the Federal University of Rio
Grande do Sul (UFRGS), Porto Alegre, Brazil. It is available through
anonymous ftp from the site caracol.inf.ufrgs.br (143.54.2.99),
directory pub/virus/pc, file antibras.zip.


Raul Fernando Weber, Prof.
Instituto de Informatica - UFRGS
Av. Bento Goncalves, 9500 - bloco IV
Caixa Postal 15064
91501-970 Porto Alegre RS
tel: (051) 336 8399 r.6805
fax: (051) 336 5576
e-mail: weber@vortex.ufrgs.br or weber@inf.ufrgs.br