Computers & Security, 16 (1997) 416-429

A History Of Computer
Viruses -The Famous ‘Trio’
Harold Joseph Highland FICS, FACM
Editor-in-Chief Emeritus

It was not until the fall of 1987 that computer virus- was a boot sector infector. The Lehigh virus and the
es began to command worldwide attention in the Israeli viruses infected executable code. The former
popular press as well as in the trade and technical press. attached itself only to COMMAND.COM; the Israeli
Late in 1987 computer viruses struck at two universi- viruses infected .EXE and/or .COM programs.
ties in the States and one in Israel.
The trio [ 11 also differed in the media attacked. Aside
l In October 1987 the Brain or Pakistani virus from the Lehigh virus that infected both floppy disks
struck at the University of Delaware. and hard disks, the others only infected floppy disks.
These were the original versions of the viruses. Since
l One month later, the Lehigh or then a number of variants or mutations have surfaced.
COMMAND.COM virus was discovered at
Lehigh University in Pennsylvania. l Another difference was the damage or operating
difficulties caused by these viruses.
. In December, the Hebrew University at Jerusalem
found itself attacked by a computer virus. In its l The Brain sometimes destroyed several sectors of a
search it found the Friday the 13th virus but also disk but often did little more damage.
uncovered during that search were two variations
of the April 1st or April Fool virus. l The Lehigh virus, depending upon its host, would
wipe out an entire disk after a set number of DOS
These three incidents presented us with two different operations.
types of computer viruses.The Brain or Pakistani virus
The Israeli viruses were replicators, causing an increase
0 Compulit Inc., 1989. All ngts reserved.
in the size of programs. Although most viruses will not
reinfect a previously infected program, the coding of
[l] We use the term, trio, because most reports late in 1987 were about the one of the Israeli viruses was defective. It permitted the
Pakistani/Brain, the Lehigh and the Hebrew University viruses. Actually
the Hebrew University wrus was not a single virus but consisted of sever-
reinfection of an infected program. Because of the viral
al very s~rmlar viruses. infection some programs were unable to be executed

416 0167-4048/97$17.00 0 1997 Elsevier Science Ltd

 Computers and Security, Vol. 16, No. 5

since there was insufficient memory In other cases there that keeps part of itself ‘hidden’ in bad sectors on the
was a substantial increase in program execution time. infected disk; it is not complete within its boot sector.

The target disks are 360K DSDD 5 l/4” disks only

How Each Virus Operates They are identified by the signature byte at the start of
the FAT. All other disks will not be infected by this
Along with each virus we have a technical report on virus.
how the specific virus operates.These reports are writ-
ten for the technician familiar with both the micro- The bad sectors are located at a minimum of cluster
computer operating system and the hardware. 37H and consist of three continuous clusters or six
sectors.The first sector contains the original boot sec-
These reports are based on extensive research using tor for the disk, with the virus itself taking up the
the virus to infect a system as well as the ‘cracking’ of remainder of the bad sectors.
the virus. Each virus was disassembled into assembly
language code in order to study how it worked. To At boot time, the Brain boot sector loads the virus
verify our work we asked Bill Kenny, a programmer itself from the infected boot sector and the three bad
with Digital Dispatch, Inc. to assist. sectors, the location of which is kept in the infected
boot record. It reserves the top 7K of memory, moves
the boot record and just-read virus into it and jumps
The Pakistani or Brain Virus into the virus code itself.

The Brain virus has the distinction of being the first The virus initialization code consists of taking over
computer virus to strike in the United States outside the INT 13H vector [disk BIOS] so that it points to
of a test laboratory. It was reported to the Computer the Brain. It also sets the INT 6DH vector to the orig-
Center of the University of Delaware on October 22, inal INT 13H vector so that the virus can use INT
1987 but it had been found in other locations on the 6DH to call the BIOS without invoking itself. The
campus one or two days earlier. This virus has struck original boot sector is then read, and control is passed
at many universities in all parts of the world and even to it so that DOS may continue the boot process.
some businesses, such as the Journal-Bulletin in
Rhode Island in the United States. In operation, the virus watches the INT 13H opera-
tions for reads to floppy disks in either the A or B
It was named the Brain because it wrote that word as drives. Based on an ‘access count’ [apparently used to
the disk label on any floppy disk it infected.An initial avoid excessive disk overhead], the Brain virus will
analysis of this virus on an infected disk revealed two check to see if this is an infected disk. If the signature
names, Basit and Amjad, with their address in Lehore, is not present [the signature, 1234H, is the word at off-
Pakistan. Because of this, the virus has also been called set 41, the disk is infected with the Brain. If the func-
the Pakistani virus. tion is a READ, the Brain will change the head, track,
and sector to the saved boot record so that the infect-
This virus is a boot sector infector. Since its code is ed boot record is hidden from casual inspection.
longer than the original boot sector, it takes over two
additional clusters on the disk.The original boot sec- During infection, three bad clusters are put into the
tor is copied in these two clusters as is the remainder FAT of the disk. The original boot record is written,
of the virus code. as noted earlier, to the first of the bad sectors and the
rest of the virus is written as the remaining sectors.
The Brain boot sector, kept in memory, is given the
How the Pakistani/Brain Virus Operates location of the bad clusters of the newly infected disk.
The Pakistani or Brain virus is a boot sector infector The infected boot sector is then written as the boot

417
H. J. Highland/A History Of Computer Viruses - The Famous ‘Trio’

record of the disk being infected. If all goes well with viously published information. Most did not have a
the infection, the label of the floppy is modified (or working copy of the Brain virus and even the few
created) with the name “(C) Brain” further marking who did, often failed to fully analyze the program’s
the disk.This labelling is not used as an infection sig- code. The following are some of the incorrect claims
nature. about this virus.

Known Bug [II “The Brain virus does not notify the user that the
disk has been infected immediately before it ruins
l The BRAIN boot sector does not have the 55H, a disk.” The brain does not ruin the disk. It may
AAH signature as the last two bytes of the sector. overwrite part of a file as it infects the disk.
As a result it may not be treated as a boot record
by some BlOSes. PI “The Brain virus demands a ransom from the
user.” This is the result of a story printed in The
Added Notes New York Times in January 1988. We were mis-
quoted by the author of that story. There is a
Wandering into psychology for a moment, the Brain message to contact the virus author(s) in the boot
virus seems to be a “look at what I can do!!” state- sector. This can be read only if the system is
ment by its author. Supposedly written to discourage booted with a write protected bootable disk and
foreigners from stealing their already-stolen software, examined by using special utilities, such as The
the virus contains a copyright notice and information Norton Utilities or PC Tools. A copy of the
about the author(s). The code quality is between fair infected boot sector is shown in Figure 1.
and poor. One portion is supposed to hide the string
used for the copyright notice in the volume label and [31 The Brain virus will infect a hard disk.” Actually
the code that creates it.Yet the Brain contains several the virus code is written so that it will never infect
other copyright notices, and anyone with basic knowl- a hard disk. It is media specific attacking only dou-
edge of the 8088 processor can see their way through ble-sided, nine-sectored 5 1 /Cinch floppy disks.
the hidden code.
[41 “The Brain is a benign virus.“Yet MS Ann Webster,
In detecting the Brain virus, it should be noted that the spokeswoman for the University of Delaware,
wide distribution and general interest have created at as well as others, have reported that the virus was
least one, and probably many hacked versions of the destructive as some files on a number of infected
virus.This makes the rendering of any signature unre- disks were destroyed. It is impossible to be both
liable.The signature used by the virus itself for identi- benign and destructive. This oxymoron can be
fication, 1234H at offset 4 in the boot record, is triv- explained by the fact that the virus may remain on
ial to change.Also, checking for the use of INT 6DH the floppy disk without doing any damage.
as the redirected INT 13H is a simple change. For Although the virus looks for its “signature” before
detection and removal, the Brain should be treated as infecting a floppy disk, we have found that it
any generic boot sector infector.-Bill Kenny sometimes reinfects a disk. It not only rewrites the
boot sector but then takes over two clusters. If
these clusters contain active files, these files might
Some Misconceptions About the Brain be lost.
Many misconceptions exist about this virus because of
incomplete and/or inaccurate statements that c51 “The Brain virus will not infect any disk unless an
appeared in newspapers. Even computer trade and infected disk is used to boot the system.“The virus
professional publications have included errors in their can infect a microcomputer and spread to floppy
accounts. Some of the professional writers, both in the disks even if the boot disk is not infected. If a
United States and abroad, based their articles on pre- non-bootable infected disk is used first in an

418
 Computers and Security, Vol. 16, No. 5

attempt to boot a system, the following message How the Virus Infects a Disk
will be displayed on the screen:
When a Brain-infected disk is inserted into a system,
Please Insert a Bootable Disk the virus first copies itself to the highest area in mem-
Then Type peturn] ory. It resets the memory size by altering interrupt
vector A21 l(18) so as to protect the RAM-resident
By that time the virus has already hidden itself in virus. It resets interrupt vector 13H to point to the
memory. Using a clean bootable disk to start the sys- virus code in high memory and also resets interrupt
tem will result in that disk becoming infected. The vector 6H [unused under DOS to point to the origi-
virus will then spread to any other floppy used on the nal interrupt vector 13H. After that the normal boot
system during that session. process is continued with the loading of both
IBMBlO.COM and lBMDOS.COM under PC-DOS

Boot Sector of Dirk Infected with Brain Virus

PC Tools Deluxe K4.11
------__--_______---_________Disk View/Edit Service----_____________---------__

Absolute sector 00000, System BOOT

Displacement -----------_----_ He:; codes --_--_------------ ASCII value
0000(0000) FA E9 4A 01 34 12 01 02 27 00 01 00 00 00 00 2U ziJ 4
0016(0010) 20 20 20 20 20 20 57 65 GC 63 6F 6D 65 20 74 6F Welcome to
0032(0020) 20 74 68 65 20 44 75 6E 67 65 6F 6E 20 20 20 20 the Dungeon

0048(0030) 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0064(0040) 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0080(0050) 20 28 63 29 20 31 39 38 36 20 42 61 73 69 74 20 (c) 1986 Basit
0096(0060) 26 20 41 6D 6A 61 64 20 28 IO 76 74 29 20 4C 74 & Amjad (pvt) Lt

0112(0070) 64 2E 20 20 20 20 20 20 20 20 20 20 20 20 20 20 d.
0128(0080) 20 42 52 41 43 4E 20 43 4F 4D 50 55 54 45 52 20 BRAIN COMPUTER
0144(0090) 53 45 52 56 49 43 45 53 2E 2E 37 33 30 20 4E 49 SERVICES..730 NI
016O(OOAO) 5A 41 4D 20 42 4C 4F 43 4B 20 41 4C 4C 41 4D 41 ZAM BLOCK ALLAMA
0176(OOBO) 2.0 49 51 42 41 4C 20 54 4F 57 4E 20 20 20 20 20 IQBAL TOWN
0192(OOCO) 20 20 20 20 20 2020 20 20 20 20 4C 41 48 4F 52 LAHOR
0208(00DO) 45 2D 50 41 4B 49 53 54 41 4E 2E 2E 50 48 4F 4E E-PAKISTAN..PHON
0224(OOEO) 45 20 3A 34 33 30 37 39 31 2C 34 34 33 32 34 38 E :430791,443248
0240(00FO) 2C 32 38 30 35 33 30 2E 20 20 20 20 20 20 20 20 ,280530.
0256(0100) 20 20 42 65 7-l 61 72 65 20 6F 66 20 74 68 69 73 Beware of this
0272(0110) 20 56 49 52 55 53 2E 2E 2E 2E 2E 43 6F 6E 74 61 VIRUS.....Conta
0288(0120) 63 74 20 75 73 20 66 6F 72 20 76 61 63 63 63 6E ct us for vaccin

0304(0130) 61 74 69 6F 6E 2E 2E LE 2E 2E 2E 2E 2E 2E 2E 2E ation...........

Figure 1.

419
H. J. Highland/A History Of Computer Viruses - The Famous ‘Trio’

Map of Brain-Infected Floppy Disk

PC Tools Deluxe R4.11

----------------------------Disk Mapping Service_________-_________________--__

Entire (disk mapped 90% free space

Track 1 1 2 2 3 3 3
0 5 0 5 0 5 0 59

Double silded Bhhhhhaaaaa.. . . ..*......................

Fhhhhhaaaaa . . . . . . . . . . . . . . . . . . . . . . . . . . .. .
Side 0 Fhhhhhaaaaa . . . . . . . . . . . . . . ..f............
Dhhhhhaaaaa.. . .X . . . . . . . . . . . . . . . . . . . . . . . .
----Dhhhhhaaaa.....X . .. . . . . . . . . . . . . . . . . . . . . .
Dhhhhaaaaa.....X . ..*..**.......*........
Side 1 hhhhhaaaaa .. . . . . . . . . . . . . . . . . . . . . . . . . . . ..
hhhhhaaaaa.......... . . . . . . . . . . . . . . . .. . . .
hhhhhaaaaa.. .................... ........

Explanation of Codes
. Available a Allocated
I3 Boot record h hidden
F File Allot Table r Read Only
D Directory X Aad Cluster

Figure 2.

or IO.SYS and MSDOS.SYS under MS-DOS. with the READ. Also if the disk is write-protected, the
infection will be terminated.
The virus is contained in the boot sector and three
contiguous clusters. A map of an infected disk is Normally the virus, in its attempt to infect a disk, will]
shown in Figure 2. search for three consecutive clusters it can mark as
“bad.” If there are no blank clusters, the virus will not
The virus, residing in high memory, interrupts any infect the disk. However, if there is only one blank clus-
disk READ request. If that request is not for the boot ter and it is neither of the last two clusters on the disk,
sector or non-floppy drive, the virus reads the boot the virus will select the one blank cluster and overwrite
sector of the disk. It examines the fourth and fifth the next two clusters and mark all three as bad.
bytes for “1234,” that are stored as 34 12, the signature
of the Brain. [See Figure I.]
A Poor Man’s Filter
If that signature is not present on the floppy disk, the A simple, inexpensive method to protect a disk from
virus infects the disk and then proceeds with the becoming infected by the Brain virus is by checking if
READ command. If the disk is already infected, the the virus is resident in memory. This can be done by
virus does not reinfect the disk but instead continues any of several utilities that show the contents in mem-

420
 Computers and Security, Vol. 16, No. 5

ory. However one can prepare a simple virus detector

by following these simple steps.
Coaparlson of Delaware Brain and Houston Brain

[II Format a floppy disk with or without a system.

ziJ 4 1
ZlJ 4
Welcome to Welcome tcl
Use DEBUG.COM, PC Tools or The Norton
tile

PI the Dungeon Dungeon

Utilities to edit the boot sector. The first line of (c) 19R6 Brain 1
Amjads (pvt) it
the boot sector appears as: h
(c)
Amjad
1966 Bait
(~vt) Lt
d VIRUS SHOE
RECORD i9.0
d. Dedicated to the
BRAIN COHPUTER
EB 34 90 49 42 4D 20 20 33 2E 32 00 02 02 01 00 SERVICES..730 NI s
dynamic
of
memorie
millions of
ZAH BLOCK ALLAMA virus who are n
IQBAL TOWN
0 longer with us
LAHOR today - Thanks
E-PAKISTAN..PHON GOODNESS!!
131Since the Brain examines the fifth and sixth bytes E :430791,44324R BEWARE OF THE .
,ZR0530.
for its signature, change those bytes to the signa- Beware of this
. ..VIRUS : \thi
S program is cat
ture of the virus, 1234. Below is an altered first line ct
vIAUS.....Conta
us for Y.SCCl"
thing progr
am follows after
of a boot sector: at1on........... these messages.

EB 34 90 49 34 12 20 20 33 2E 32 00 02 02 0100

To find out if the Brain is in the system, place this Figure 3.

altered test disk in drive B.After the system prompt,A,
type: DlR B: to obtain a directory of the test disk. If to the other variations we received earlier, the active
the system is infected by the Brain virus, the following code of the virus was not altered. In all respects, except
message will appear on the screen: the boot sector message, the two disks were identical.

Not ready, error reading drive B A comparison of the boot sector message found in the
original version of the Brain [left] and the University
Abort, Retry, Ignore? of Houston’s copy [right] is shown in Figure 3. We
wonder why did the author of the new version retain
The disk with the altered boot sector will work only the original copyright notice?
on a non-infected system.
We often use a ‘version’ of the Pakistani/Brain virus
when we demonstrate a number of computer viruses
Some Variations of the Brain during our speeches. The ASCII portion of this virus
Since the Brain first appeared at the University of is easily modified. By preparing a dedicated virus we
Delaware there have been many variations reported at can emphasize the ease with which anyone can alter
different locations. Early in November 1988, for an existing virus.Two of these modified versions of the
example, one such version infected about 300 com- Pakistani/Brain virus are shown in Figure 4.
puter library disks at the School of Business at the
University of Houston. How many disks, owned by Late in 1988 we received a set of public domain pro-
students and faculty, that might have been infected is grams on a special disk with a supplier’s label that we
difficult to determine. recognized. The disk had been sent from a different
city in a disk mailer without a sender’s return address.
Professor Shafique Pappa of the University sent us a Checking the disk we found that it was infected with
copy. In comparing this version with the original a mutation of the Pakistani/Brain. Unlike the original
found at the University of Delaware, we found that Pakistani/Brain virus this one’s code was altered so
someone had edited the boot sector message. Similar that it infected the C drive, the hard disk. How many

421
H. J. Highland/A History Of Computer Viruses - The Famous ‘Trio’

The students who worked at the Computer Center’s

checkout counter found that an increased number of
disks were returned by students because the disks
BEN VENUTT ALLA Welcome to
FIERA DI MII.ANO Edmonton
failed to boot. It was also noted that it was not possi-
CIUGNO ble to obtain a copy of the disk’s directory under
... . . . . ...*..... DOS. Furthermore, at the university’s microcomputer
... .
CIPS laboratory that is open to all students, the student assis-
This virus for COMPUTER
tants in charge of the laboratory found that they had
Professori CONFERENCE
Francesco Car-din an increased number of hard disk crashes.
and the This new virus
University of is in honor of
Milano Jim Finch, CIPS When the student assistants examined the remaining
disks in the loan library they were surprised to find
June 9, 1989 June 1, 1989
that there was too recent a date for the COM-
MAND.COM program when a disk directory was
viewed on the screen.

Figure 4. As a result they compared the COMMAND.COM

program on the suspected library disks with the one
individuals in an office environment would examine on the source DOS disk.They used the DOS debug
the disk prior to making a backup copy? program to obtain an assembly language listing of both
[a] an original protected version and [b] the suspect
For almost two years we have examined each disk COMMAND.COM programs. Thus they were able
prior to making a backup. We use PC Tools or the to isolate the virus.
Norton Utilities to obtain a ‘map’ of a disk and search
for bad clusters, a favorite hiding place for some types
of viruses We also examine the boot sector to deter-
The Basic Virus Routine
mine if it is ‘clean’ and does not contain a computer The following is a pseudo-code representation of the
virus. We also read each .BAT and text file using PC Lehigh virus developed by Kenneth Van Wyk of
Tools or the Norton Utilities and not the standard Lehigh University:
DOS commands. This is the minimum procedure
before we accept a disk to run on our system.
begin
IF AnotherDishlsBeingAccessed THEN
Lehigh or COMMAND.COM Virus IF (TheOtherDiskIsNotInfected AND
TheOtherDisklsBootable) THEN
The Lehigh or COMMAND.COM virus was discov- CopyVirus
ered at Lehigh University in Bethlehem, PA late in Increase(Counter)
November 1987. It was found at the start of a school IF HardDisk THEN
recess and some students had already gone home with StoreCounterOnDisk
infected disks. IF Counter = 4 THEN
DestroyOriginal
At Lehigh University’s Computer Center they issued end
microcomputer program disks to students in the same
manner as a library loans books.These disks are to be How the Virus Worked
used for do homework assignments on the machines
in the university’s microcomputer laboratory or even Although this attack is analyzed in terms of micro-
at the student’s home or dormitory. computers, it is apparent that a very similar technique

422
 Computers and Security, Vol. 16, No. 5

could be employed with mainframes. in the system. Writing over these sectors wipes out
the disk’s boot tracks and the directory tables, thus
1. The virus code was originally implanted in rendering the disk useless.
COMMAND.COM, a systems file that is essential
for a DOS computer to boot. It is similar to the Although a very skilled programmer might be able to
IPL [initial program loader] of a mainframe. recover some of the disk’s data, it is doubtful that this
COMMAND.COM is also used periodically for procedure is worth the effort.The time would be bet-
other microcomputer applications. The virus code ter spent in reformatting the disk and loading the
was stored in a stack within COMMAND.COM. backups.
Therefore, the length of the tile was not changed
In addition to locating itself in the stack space, the
virus had inserted a ‘jump’ instruction at the How the Lehigh Virus Operates
beginning of COMMAND.COM so that it was The Lehigh virus, as it is commonly known, is a virus
directed to the embedded virus whenever the pro- that attacks only COMMAND.COM, and spreads
gram was called. itself by becoming resident in memory, along with the
normal COMMAND.COM, and later infecting other
2. When a microcomputer is booted with an infected disks (usually floppies).
disk, the altered version of COMMAND.COM
remained in memory.The virus code therefore was The virus signature consist of the last word (two bytes)
present in the infected microcomputer’s memory. of the infected COMMAND.COM file, and contains
the value 65A9h (Oa9h, 65h)
3. The virus intercepted the standard DOS function
requests at interrupt 21H. A number of functions When COMMAND.COM is loaded, the virus initial-
are performed at this interrupt; for example, this ization code allocates a block of memory, copies the
interrupt is used to output characters to the virus code there, saves the current INT 21 vector both
screen. The virus waited for either an “execute in memory and in the INT 44 vector, and points the
program” or “find first file” request by a user, such INT 21 vector at the resident virus code. Control is
as DIR, TYPE, etc. that are very frequently used. then returned to the normal COMMAND.COM. It
should also be noted that invoking a command shell
4. Once one or these functions was requested, the (which many programs do to process commands or let
virus code was activated. First the virus checked to the user use a DOS command) will install the virus
see whether the disk being accessed was bootable, again, so that multiple copies are active. Be warned,
that is, contained a copy of COMMAND.COM. however, that the memory allocated for the virus will
If it did, the virus copied itself onto the disk and go away with the command shell, but the INT 21 and
then incremented a counter. In a two-floppy disk INT 44 links will not, so that another program
system, the counter remained in memory; in a re-using the memory will crash the system.
hard disk system the counter was stored on the
hard disk. Although a reboot reset the counter to To infect further COMMAND.COM’s, the virus
zero in a two-floppy disk system, the same was not watches functions 4BH (load program) and 4EH (find
true with a hard disk system. first matching file) of INT 21H. When it finds either
function, it takes the drive letter of the passed filename
5. When the counter was equal to or greater than 4, or the current default disk, if the passed filename does
the second part of the virus was called to start its not contain a drive letter, and checks for COM-
destructive work. This second part of the virus MAND.COM on that disk. If it exists, and does not
used the DOS interrupt 26H (absolute disk write) have the signature, it is infected with the virus and the
to write a series of zeroes to the first 32 sectors of infection counter is incremented. When the counter
the parent disk, or the hard disk if there was one reaches 4 and the boot disk is not a hard disk and the

423
H. J. High/and/A History Of Computer Viruses - The Famous ‘Trio’

last infected disk was A or B and the last infected disk the BITNET warning message to other universi-
is not the current disk, two things happen: ties, and

[l] 32 sectors worth of data are written from the . the virus was developed by someone with “a very
ROM segment (the OFEOOh segment) to disk, very sick mind.”
trashing the boot sector, FATS, root directory, and
some data. Fortunately, the virus programmer made several mis-
takes.
[2] A ‘string’ from the ROM segment is sent to the
screen.The DOS call then proceeds normally. First, standard DOS functions were used to copy the
virus code. This caused the write date of the COM-
Known Bug: MAND.COM file to be changed. A professional
would have covered his/her tracks and avoided chang-
l The direction flag is not cleared before a string ing that date which served to alert those who did the
primitive (MOVSB), so that its correct operation autopsy.
is not guaranteed.
Second, the virus writer never checked to determine
Comments: if a write protect tab was used on a disk. Thus, if an
unsuspecting user tried to obtain a directory of a pro-
The virus assumes that COMMAND.COM will tected disk, a DOS “write protect error” would appear
always end in data (stack?) space that may be safely on the screen.This should alert a user to suspect that
over-written. If it is truly safe to over-write it, why is something was wrong. Many inexperienced users
it included in the file instead of simply using the probably would have removed the protect tab and
memory after the end of the file (since its value does continued, not knowing what was happening.
not matter, that fact that it is random memory is irrel-
evant)? Furthermore, in testing the virus it was found that it
could not compromise security such as a file set to
The virus also assumes that COMMAND.COM will read only Because of this a well set up local area net-
always start with a 3-byte JMP to some initialization work [LAN] would probably be safe from this virus.
routine. Microsoft and/or IBM and/or COMPAQ
and/or... do not guarantee this, so this will probably fail
under some (possibly future) version of DOS. - Bill The Israeli Viruses
Kenny
In December 1987 the Hebrew University of
Jerusalem discovered that its microcomputers had
Postscript been infected with a virus.They found that a program
The university’s computer center alerted students and that had often been run in the past was suddenly too
faculty members to the possible danger.Van Wyk also large to fit into memory. Upon closer examination the
sent out a warning on the BITNET communications computer specialists under Yisrael Radai of the
network to alert other universities of the virus danger. Computation Center of the University found that
In our talks with Kenneth van Wyk he noted that: every time an .EXE program was executed, its size
increased by 1808 bytes. The .COM programs
. the virus code was about 346 bytes long, located increased in size as well but there was only a one-time
between 59AF and 5B09, increase.

. an unsuspecting student probably picked up the As the computer center staff and a group of students
virus from a bulletin board; the reason for sending from the Computer Science Department of the

424
 Computers and Securit- Vol. 16, No. 5

University searched tor the virus they encountered a l If the year is not 1987 and the date is not Friday
new phenomena. Not only had the virus increased the the 13th, it takes over the clock interrupt, INT
size of executable programs but within 30 minutes 8H, to cause ‘harmless’ mischief. It then searches
after the microcomputer’s memory was infected, all the environment for the name of the executing
processing was dramatically slowed. Further investiga- program, and does a load and execute program call
tion revealed that when the virus had infected the on it. Since the virus is hooked into INT 21H
memory and the date of the computer system was any already, it will not try to install itself again. When
Friday the 13th starting in 1988, any program that was it returns from this call, it finishes installing itself as
being executed was erased from the disk.These find- a resident program.
ings were based on analysis of the virus and verified by
actual experimentation. As a resident program, the virus has several functions:

[l] Serves as a signal not to install itself again.

How the Jerusalem Virus Operates
This virus is a general executable infector, capable of [2] Provides functions for the virus to work prop-
infecting both .COM and .EXE files. It notes the type erly
of file being infected [see bugs noted below], and
places it in the appropriate location. It sets the appro- [3] Infects other programs.
priate links, if any, to execute the virus first. This virus
also installs itself as a TSR. to extend DOS with addi- [4] Performs appropriate ‘mischief.’
tional functions.
To infect other programs, the virus takes over function
The virus signature is two-fold, one part of which 4BOOH of INT 21H. When this function is called, it
does not work well. First, the virus must find if the res- checks to see if the requested program is COM-
ident portion of the virus is already installed. It does MAND.COM. If it is COMMAND.COM, it leaves
this by calling DOS INT 21H with function OEOH. If the program untouched. If it is not
the virus is not installed, the return in AH will proba- COMMAND.COM, the virus checks the last letter of
bly still be OEOH [possibly varies with DOS version]. the filename extension. If it finds an M or m, it
If installed, 0300H is returned in the AX register [AH assumes a .COM file and performs that infection.
= 03H, AL is not checked upon return]. The other Otherwise it infects the called program as an .EXE
part of the signature is a five character string, file. It then checks the last 5 bytes of the file. If they
“MsDos,” as the last 5 bytes of the program. Due to a are “MsDos,” the virus signature, it leaves the file
programming lapse, however, this does not hold true alone; otherwise it infects it. During infection, the file’s
for .EXE files [see bugs noted below]. time, date, and attributes are preserved.After it is done,
the virus calls the original INT 21H vector to per-
If the virus is already resident, the original program is form the actual loading and execution.
executed. If it is not resident, the virus moves itself
down to the start of memory after the PSP and takes If it finds that the “Friday the 13th” flag is set, instead
over the TNT 21H vector. Next it checks the current of executing the program the virus deletes it. Then it
date: passes the name to DOS, which will return a notice
that the program cannot be found.
. If the year is 1987, it does nothing.
If the clock interrupt, INT8H, is taken over, each ‘tick’
. If the year is not 1987 and the date is Friday the decrements a counter that is initially set to just under
13th, it sets a flag to be destructive instead of 30 minutes. When the counter expires, the virus first
infecting the program. scrolls part of the screen, messing up whatever is dis-
played, and then at every ‘tick’ (18.2 times a second)

425
H. J. Highland/A History Of Computer Viruses - The Famous ‘Trio’

performs a large number of useless operations, slowing beyond the end of the TSR. If this function is
down the system. called the stack can destroy the information in the
next memory control block.
Known Bugs
The virus assumes that the filename passed to the
The virus assumes that DS contains a meaningful load and execute program function has a maxi-
address after a load and execute calLThis may be mum of 65 bytes.Although any length name may
true for some DOS versions, but is far from guar- be passed, DOS will use a maximum of 64.
anteed for all.
The author of the virus apparently forgot to set
In the virus DOS functions ODDH and ODEH, it the signature during .EXE file infection.This will
assumes that the direction flag is cleared upon cause multiple infections of .EXE files.
entry, but this is not guaranteed.
Note: Despite this extensive bug list, this is one of the
It assumes that .COM and .EXE extensions are most interesting viruses we have examined because of
used exclusively and that they are meaningful.This its ability to infect both .COM and .EXE files. - Bill
is wrong since they are merely DOS conventions. Kenny
A program name passed to the load and execute
function may have any name, with or without an
extension.Also the file type [.COM and .EXE] is Reports about the Virus Attack
determined by the .EXE signature bytes at the Because information about the Friday the 13th virus
start of the file, not the filename extension. was limited outside of Israel, news reports were too
often based on hearsay. Some papers treated the virus
The virus uses multiple prefixes on a MOVSB as a joke, a student prank. At the other extreme were
instruction path REPZ and a CS: segment those stories that reported the attack by a killer virus.
over-ride] without disabling interrupts. On both
the 8086 and 8088 processors when an instruction A front page story in The NewYork Times on January
with multiple prefixes is interrupted, the address of 31, 1988 reported that the virus was apparently
the last prefix is pushed to the stack and not the intended as a weapon of political protest.The author
first prefix. Thus when returning from the inter-
rupt only the last prefix is present when the
instruction starts executing again. This leads to [3] The author of The New York Times article also attributed a quotation
erratic behavior if not a system crash. to us that we never mad. In that article he wrote that we reported that the
BrainVirus contained a random demand for f2000.We had told the author
in an interview that we had heard reports about the virus but had not seen
It also changes the stack with interrupts ON. it. In our conversation he noted that he heard that the Pakistani virus
authors had asked the ‘victims’ to write to them. The author, knowing that
Some early 8088 processors had a bug which per- we had taught many foreign students, asked if we could guess how much
mitted interrupts after a change to a segment reg- payment might be requested. We noted that some students might ask for
$200, some might ask for $2 000 and others $20 000.
ister. An interrupt in the middle of changing SS
and SP therefore uses an invalid stack. Smce we knew the author for several years and since we had a tape of our
telephone interview we did not write to the author but telephoned him. We
know the job of putting rapidly gathered notes together to write a story and
It assumes that the name of the current program could appreciate his making an error. Having worked for newspapers in the
can be found in the environment but this is true past we did not request printing a correction. Even if the newspaper did so,
it might appear hidden somewhere in the paper many days later
only under DOS 3.0+
What is disturbmg is that most of that article has appeared in print in
In the virus DOS function ODEH [move and exe- newspapers and magazines all over the world. Probably more serious is the
fact that future researchers in this field will pick up inaccurate and/or
cute an .EXE file] which is never called by this incomplete parts of the story and include these quotations with appropri-
virus, the virus sets the stack pointer to an area ate footnotes. Some author3 of recent books have already done so - HJH

426
 Computers and Security, Vol. 16, No. 5

of that article, in reply to Mr. Radai’s letter, wrote that “APRIL 1ST HA HA HAYOU HAVE AVIRUS”
he “was too quick to assume too much about this
virus, its author, and its intent.“[3] After the message is displayed the system enters an
infinite loop with the interrupts off causing the system
Because of The New York Times story the virus has to crash.
often been called the PLO virus.Yet, according to Mr.
Radai all users had been alerted and to his knowledge The April 1st COM virus is virtually identical except
no files were actually deleted on Friday 13, 1988. that infects .COM files.Also if the year is 1988 or later
and the date is between January 1st and March 31st,
the COM virus displays the following message on the
Other Viruses Found screen:

Three other viruses were found at Hebrew University “YOU HAVE AVIRUS !!!”
during their computer virus search. One was a variant
of the Friday the 13th or Jerusalem virus. But if the year is 1988 or later and the current date is
April lst, this virus acts the same as the EXE virus in
The Friday the 13th virus attacked both .EXE and that it displays the message:
.COM programs. However, it did not attack COM-
MAND.COM, thereby permitting the system to con- “APRIL 1ST HA HA HA YOU HAVE A VIRUS”
tinue operating. The variant of this computer virus is
identical to the widely-known Friday the 13th virus and entering an infinite loop, the system hangs and
but with two small exceptions: requires a cold boot to restart the system.

Ill The signature had been changed from We have some variants of both of the April 1st virus-
“sUMsDos” to “URI2V21.” es. Not having access to the original Israeli versions we
are uncertain which are the original and which are
PI The do-not-infect-this-program name routine later variants. In one the virus executable name is
had been changed from: “VIR$$VIR.EXE;” in another the name is
“TMPSTMPEXE.” Furthermore, one has a version
“COMMAND.COM” to “MMMMMMM.ZZZ.” number of “3.00” and another’s version number is
“2.01.”
In the version of this variant that we have examined,
the only other differences are in the infected (host)
program and the ‘leftover’ values in the variables,
How the April 1st EXE Virus operates
which do not affect the action of the virus. This April 1st virus is a general .EXE infector, which
works by installing itself as a resident program to
extend DOS with additional features. It will not install
The April Fool Viruses itself if the April lst.COM virus is installed.

The other two viruses discovered have been called the The virus uses ‘two’ signatures, one of which is an addi-
April Fool viruses or the April 1st virus. One infected tional DOS function. If the additional function (ODEH)
.EXE files and the other .COM files. exists, the original program executes, and there is no
return from the DOS call. If the function does not exist,
The April 1st EXE virus when activated checks the the call returns, and the virus installs itself. The other
current date. If it is April 1st, the virus decrypts a string part of the signature is the virus placing the value
contained within the virus and displays the message 1984H in the checksum field of the .EXE header. This
on the screen: is as (un)likely as any other checksum value [l in 65536

427
H. J. Highland/A History Of Computer Viruses - The Famous ‘Trio’

or lower, as some linkers do not set the checksum field]. Known Bugs
and makes a reasonable signature.
* Like the April 1st COM virus, the direction flag is
If the virus is not resident, the initial call to the virus never cleared.
DOS function fails, which causes the virus to install
itself. It takes over the INT 21H vector, then finds the * Also as in the case of the COM virus, the one
name of the current program in the environment, and assumes that the name of the current program can
does a load and execute program call to DOS. This be found in the environment, true only under
second call does not try to install itself as INT 21H DOS 3.0+.-Bill Kenny
already points to the virus. When the program exists,
the virus finishes making itself resident.
How the April 1st COM Virus Operates
The virus, during installation, checks the current date. This April 1st virus is a general .COM infector, which
If it is April lst, the virus decrypts a string which it works by installing itself as a resident program to
displays on the screen: extend DOS with additional features.

“APRIL 1ST HA HA HAYOU HAVE AVIRUS” The virus uses two ‘signatures’, one of which is an
addition DOS function. If the additional function
It then enters an infinite loop with interrupts off and (ODDH) exists, the original program executes, and
crashes the system. there is no return from the DOS call. If the function
does not exist, the call returns and the virus installs
If the year is 1980 or 1988 or after and the date is a itself. The other part of the signature is the first two
Wednesday after April lst, the virus takes over the sys- bytes of a text string, “sURIV”, which is checked for
tem timer tick INT 1CH. When the count reaches during infection of subsequent files.
about 55 minutes, the virus goes into an infinite loop
crashing the system. Also, the counter is not zeroed If the virus is not resident, the initial call to the virus
when an infection takes place, so each later infection DOS function fails, which causes the virus to install
has a shorter ‘time fuse’. itself. It takes over the INT 21H vector, finds the name
of the current program in the environment, and does
To infect other programs, the virus takes over function a load and execute program call to DOS.This second
4BOOH of INT 21 h. When this function is called, the call does not try to install itself, as INT 21H already
virus program checks if the requested program has the points to the viruswhen the program exists, the virus
extension EXE. If it is EXE and the checksum in the finishes making itself resident.
program header is not 1984H, the file is infected.The
infection program uses a temporary file, To infect other programs, the virus takes over function
TMP$$TMPEXE, to create the infected file.After the 4BOOH of INT 21H [load and execute program].
infected program is built into the TMP$$TMI?EXE When this function is called, it checks to see if the
file, the original file is deleted. The temporary file is requested program has the extension .COM. If the
then renamed to the original file with the original program name is not COMMAND.COM, the pro-
time and date. gram is scanned for the 2-byte signature string “su”.
If it passes all these tests, the file is infected.The infec-
An interesting quirk is the virus containing code to tion uses a temporary file,TMP$$TMP.COM, to cre-
deal with the situation of a return from a TSR DOS ate the infected file.After the infected program is built
call, a situation that cannot exist. into the TMP$$TMP.COM file, the original file is
deleted and the temporary file renamed to the origi-
nal file and maintains the original time and date.

428
 Computers and Security, Vol. 16, No. 5

After infecting a file, the DOS date is examined. If the l The drive information passed to the just-infected
year is earlier than 1988, or the date is later than April program in the AX register is the information for
lst, the requested program executes normally. If the the original infected program, and does not corre-
year is 1988 or greater and the date is earlier than April spond to the command line entered.
lst, the virus displays the message:
l When the name of the program being called for
“YOU HAVE AVIRUS!!!” execution is copied into a local buffer, only 63
characters are copies.The passed name may be any
and executes the requested program normally. If the length, but only 64 are significant.
year is 1988 or greater and the date is April lst, the
virus displays the message: l When searching the file name for the extension, it
is assumed that a period will be found.The name
“APRIL 1ST HA HA HA HAYOU HAVE AVIRUS” passed to DOS function 4BOO may be anything,
and a period is not guaranteed.
and goes into an infinite loop that crashes the system.
. It is assumed that the extension is significant [deter-
Known Bugs mines fle type]. The .COM extension is a DOS
convention, and may contain a file in the .EXE for-
mat.The true way to tell file type is to check for an
l The direction flag is never cleared, although the .EXE signature at the start of a program.
program assumes auto-inc [flag cleared] for string
primitives. l When allocating a memory block to infect a pro-
gram, it is assumed that the allocation will succeed.
. The program assumes that the name of the current If the memory is not available, low memory [corre-
program can be found in the environment, which sponding to the error code] will be over-written,
is only true under DOS 3.0+. probably crashing the system. -Bill Kenny.

429