FROM:    Vesselin Bontchev             Area # 42 (      VIRUS       )
TO:      All                           MSG # 491, Sep-26-90 11:54pm
SUBJECT: A virus description scheme

                 A virus description scheme

     1. File infectors.
     The description of each file infector consists of four parts - the name of 
the virus, its descriptor, its signature and its text strings.

     1.1. The virus name.
     It has the form
          <prefix>-<infective_length>[<suffix>].

     1.1.1. The prefix.
     It consists of one or more upper case letters which indicate which files 
does the virus infect. These letters can be as follows:

     C - The virus infects COM files;
     E - The virus infects EXE files;
     J - The virus is written (and infects files written) in the Job Control
         Language of the system (e.g., BAT file, REXX file, etc.);
     L - The virus infects libraries;
     N - The virus infects BIN files;
     O - The virus infects OBJ files;
     S - The virus infects device drivers (SYS files);
     T - The virus infects source files (C, PAS, FOR, etc.);
     V - The virus infects overlays;
     W - The virus is of "spawning" type (companion virus).

     1.1.2. The infective length.
     It has the form
          <virus_length>[(garbage_prefix)][(garbage_suffix)]
where
     <virus_length>   is the length of the true virus body;
     <garbage_prefix> is the number of bytes that the virus appends before
                      its body and
     <garbage_suffix> is the number of bytes that the virus appends after its
                      body (or after the infected file).
     Either of <garbage_prefix> or <garbage_suffix> are optional and may have 
the form <lower_limit>-<higher_limit>.

     1.1.3. The suffix.
     It is optional and is used to distinguish between several variants of a 
virus that have the same length.

     Example: The Jerusalem-B virus name in this notation is
          CE-1805(0-15)(5)b.

     1.2. The descriptor.
     The descriptor of a file virus consists of a sequence of groups. Each group 
begins with an upper case letter and is followed (optionally) by several lower 
case letters and/or numbers. Each group describes a property of the virus. For 
instance the description "XabYcZdmt" lists three properties - X (with value 
"ab"), Y (with value "c") and Z (with value "dmt"). The possible properties and 
their values are as follows:

     A - handling of the ReadOnly attribute (y - removes the attribute, then 
restores it; n - does not infect if the attribute is set; r - removes the 
attribute but does not restore it);
     B - critical error handler (y - has such a handler; n - does not have it);
     C - infection of COMMAND.COM (y - infects it as any other file; n - does 
not infect it; o - infects only it; d - infects it differently than the other 
files; s - infects it by searching through the COMSPEC variable or by destroying 
its transient part);
     D - file data & time stamp (y - changes it; n - does not change; s - 
changes only separate fields e.g., seconds, months, years, etc.);
     E - how the virus distinguishes between COM and EXE files (e - using the 
extension; s - using the first two bytes of the file, which are checked for 
`MZ'; b - the first two bytes are checked for `ZM' too);
     F - length of the smallest infectable file (c<number> - minimal length for 
COM files; e<number> - minimal length for EXE files; n - no minimal length 
control);
     I - file length increment (c<number> - constant; p<number> - aligns to a 
paragraph boundary; r<number1>-<number2> - random, between <number1> and 
<number2>; n - does not increase file length. Each property can be prefixed by 
one of the letters C, E, J, L, N, O, S, T to indicate the file length increment 
for the respective file type);
     J - first instruction handling for COM files (n - no particular handling; j 
- infects only files that begin with a JMP instruction; s - does not infect 
files that begin with a JMP; x - if the first instruction is a JMP or a CALL, 
then the virus modifies not it, but the instruction it points to;
c - places a CALL to its code, instead of a JMP; o - transfers control to its 
body in a different way);
     K - how much times a file can be infected (<number> - that number of times; 
m - multiple times; Each property can be prefixed by one of the letters C, E, J, 
L, N, O, S, T to indicate the file length increment for the respective file 
type);
     L - length of the virus body;
     M - "stealth" techniques used (c - uses encryption; d - DIR does not 
display the increased file size; f - auto-disinfection on file reading; g - uses 
antidebugging techniques; i - bypasses interrupt monitors; m - mutates; t - 
auto-disinfection on tracing or disassembling; n - no "stealth" techniques 
used);
     O - does the virus overwrite parts of the file (y - yes; n - no; s - yes, 
if the EXE header information is incorrect);
     P - place in the file where the virus resides (b - in the beginning of the 
file; e - at the end of the file; m - in the middle of the file; r - at a random 
position in the file; o - outside of the file. Each property can be prefixed by 
one of the letters C, E, J, L, N, O, S, T to indicate the file length increment 
for the respective file type);
     S - infection strategy (c - only in the current directory; only on the 
current drive; e - on file execution; o - on file opening/closing; p - searching 
the PATH variable; r - on file reading; o - only in some directories, e.g., the 
root directory);
     U - maximal infectable file length (<number> - maximal infectable length; n 
- infected COM files may become larger than 64 K; y - infected COM files are 
never larger than 64 K; e - infects only EXE files below 64 K, converting them 
into COM format.
     X - caused effects (v - video effects; m - displays messages; p - plays 
music or has sound effects; b - causes keyboard problems; s - overwrites 
sectors; e - intentionally causes errors, e.g., divide by zero, parity check, 
etc.; r - causes problems to the resident programs; k - destroys the
contents of files; d - deletes files; o - causes problems on overlay loading; w 
- scrambles or encrypts the contents of data files; z - wipes out the 
information on the disk; f - formats the disk; l - low-level formats the disk; a 
- destroys or scrambles the FAT; t - performs trojanization of
files);
     Y - where in memory resides the virus (n - is not memory-resident; h - in 
higher end of memory; l - in lower end of memory; d - in an unused hole in DOS; 
i - in the interrupt vector table; v - in video RAM; f - in the free
memory; b - in the DOS buffers; x - in the extended memory; p - in the expanded 
memory).

     1.3. The signature.
     The signature consists of sequences of pairs. Each pair consists of a hex 
string (possibly containing wildcards) and a hexadecimal offset from the 
beginning of the virus code (NOT from the virus entry point or from the 
beginning of the part that begins after the end of the original file), where
this signature resides.

     1.4. The text strings.
     They are similar to the signature and also consist of pairs (text string 
and offset). However ALL meaningful text strings that appear in the virus body 
are given.

<continues with the next message>
--- XRS 3.30
 * Origin: A Bulgarian antivirus researcher (RAX 2:359/1.12)
SEEN-BY: 2/225 241/1 2 242/20 244/1 310/11 490/1 10 20 40 60 
SEEN-BY: 504/156 310 507/1 13 430 440 642 7000 9001 512/0 515/1 
SEEN-BY: 515/801 821 841 871 
