Macro Virus Table - Defense Technical Information Center

PC
MS-DOS/PC-DOS Computer Viruses
working hard -2/14/92
v6-126: CoffeeShop has same author as Cruncher virus.
v6-151: At least one anti-virus program can detect and remove Coffeeshop.1568.
Name: Mutator
Aliases: Mutator Type:
Disk Location: Features:
Damage: Size: See Also:
Notes: v6-151: At least one anti-virus program can detect and remove Mutator (307 and 459).
Name: N8FALL
Aliases: N8FALL Type: Program.
Disk Location: COM application.
Features: Sometime displays message.
EXE application.
May drop a ’CHILD’ non-polymorphic
COMMAND.COM
companion virus.
May cause software problems ( false free
memory available ) .
Damage: Sometime displays Size: About 5800 byte long. See Also:
message.
Polymorphic: each infection
May drop a ’CHILD’ nonpolymorphic
companion virus.
May cause software problems
( false free memory available )
.
different
Notes: The following notes are extracted from VB, May 1995:
N8FALL is about 5800 byte long; It is quite complex and stealth, and employs DOS commands
and functionality to its own advantage.
When an infected file is executed, the virus checks for itself in memory by finding the value at
000:05E0h. If the returned value is JMP VIRUS instruction, then N8FALL follows the instruction
and determines that its indeed a memory resident. If the virus is memory resident, control is
returned to the host program. Otherwise, It attempts to install itself in system memory.
First, N8FALL calls Int 13h, Int 21h, and Int 2Ah vectors to check to anti-virus program as well
as using them for its own installation, infection, etc. If any found, then they are disabled for salve
preservation. Second, It looks for HIMEM.SYS. It uses Int 21h handler to determine the
residence of DOS interrupt handler. If interrupt handler is in high-memory, then the area next to it
will be over written with JMP VIRUS instruction. If interrupt handler is in low-memory, then it
will be overwritten with JMP VIRUS instruction. Next, it opens COMMAND.COM files and
closes the file, now COMMAND.COM is infected. Finally, N8FALL decrypts the string
’C:\NCDTREE\NAVINFO.DAT’ which is name used by Norton Anti-Virus program. Control
now is returned to the host program.
The virus infects COM and EXE files. Before infecting any file, it conducts checks so that 1)
anti-virus program are exclude. 2) floppy disk are not write-protected. 3) DOS error messages,
VSAFE, and Microsoft’s TSR are disabled. When all these conditions are satisfied, the virus
examines the lower five bits of the file, if they are all set to 1, then it becomes a candidate for
infection. Next, the last 24 bytes are read and decoded. The virus look for its ID in this area. If the
250 CIAC Computer Virus Information Update May 21, 1998