here is a complete description of the virus.
is a Windows95 specific parasitic PE files (Portable Executable)
infector about 1Kbyte of length. This virus was found "in-the-wild"
in Taiwan in June 1998 - it was posted by the virus author
to a local Internet conference as a some utility. Within a
week the virus was found in Austria, Australia, Israel, United
Kingdom, and was also reported from several other countries
(Switzerland, Sweden, USA, Russia, Chile and the list keeps
virus installs itself into the Windows memory, hooks file
access calls and infects EXE files that are opened. Depending
on the system date (see below) the virus runs its trigger
routine. The virus has bugs and in some cases halts the computer
when an infected application is run.
virus' trigger routine operates with Flash BIOS ports and
tries to overwrite Flash memory with "garbage". This is possible
only if motherboard and chipset allow to write to Flash memory.
Usually writing to Flash memory can be disabled by a DIP switch,
however this depends on the motherboard design. Unfortunately,
there are modern motherboards that cannot be protected by
a DIP switch - also, some of them do not pay attention for
switch position and this protection has no effect at all.
Some other motherboard designs provide write protection that
can be disabled/overriden by software.
tests in our lab the virus did not overwrite the Flash BIOS
and just halted the computer. We do however have reports from
other sources telling that the virus really is able to mess
trigger routine then overwrites data on all installed hard
drives. The virus uses direct disk write calls to achieve
this and bypasses standard BIOS virus protection while overwriting
the MBR and boot sectors.
are three virus versions known, which are very closely related
and only differ in few parts of their code. They have different
lengths, texts inside the virus code and trigger date:
Text Trigger date Found In-The-Wild
CCIH 1.2 TTIT on April 26th YES
1010 CCIH 1.3 TTIT on April 26th NO
1019 CCIH 1.4 TATUNG on 26th of any month YES - many reports
While infecting a file the virus looks for "caves" in the
file body. These caves are a result of the PE file structure:
all file sections are aligned by a value that is defined in
PE file header, and there are not used blocks of file data
between the end of previous section and next one. The virus
looks for these caves and writes its code into them. The virus
then increases the size of sections by the necessary values.
As a result the file length is not increased while infecting.
there is a cave of enough size, the virus saves its code in
one section. Otherwise it splits its code into several parts
and saves them to the end of several sections. As a result
the virus code may be found as set of pieces, not as a single
block in infected files.
virus also looks for a cave in the PE header. If there is
a not used block not less than 184 bytes of length, the virus
writes its startup routine to there. The virus then patches
the entry address in the PE header with a value that points
to the startup routine placed in the header. This is the same
trick that was used in the "Win95.Murkry" virus: address of
program entry points not to some file section, but to file
header - out of loadable file data. Despite this, infected
programs are run with no problems - Windows does not pay attention
for such "strange" files, loads the file header into the memory,
then file sections, and then passes control to the virus startup
routine in PE header.
the virus startup routine takes control, it allocates a block
of memory by using the PageAllocate VMM call, copies itself
to there, locates other blocks of virus code and also copies
them to allocated block of memory. The virus then hooks system
IFS API and returns control to the host program.
most interesting thing in this part of the virus code is that
the virus uses quite complex tricks to jump from Ring3 to
Ring0: when the virus jumps to newly allocated memory its
code is then executed as Ring0 routine, and the virus is able
to hook the file system calls (it is not possible in Ring3,
where all users applications are run).
IFS API virus handler intercepts only one function - file
opening. When PE .EXE files are opened, the virus infects
them, provided there are caves of enough size. After infection,
the virus checks the file date and calls trigger routine (see
running its trigger routine the virus uses direct access to
Flash BIOS ports and VxD direct disk access calls (IOS_SendCommand).
and Cleaning instructions-
Download and install AntiViral Toolkit Pro for DOS.
The virus does not infect 16 bit executables (DOS programs)
so you can safely install AntiViral Toolkit Pro without infecting
it with the virus. The direct URL link to AntiViral Toolkit
Pro is: http://www.avp.com/files/avpdevl.zip
You will need to create a special DOS boot disk according
to the instructions below.
a. Place a blank diskette into your floppy disk drive that
you can boot your computer from. Usually this is your "A"
b. Open a DOS Window and type
Format /s A:
"A" to another drive letter if this is not the diskette drive
you inserted the diskette into.
This will create a boot disk that you can restart your computer
c. Now change to your windows subdirectory and copy the file
HIMEM.SYS to the "A" drive
You need to create a special configuration file named CONFIG.SYS
on the "A" drive as follows.
Remove the diskette and write protect it.
a. Insert the diskette back into your computers diskette drive.
b. Shut down your computer and turn the power off.
c. Wait 15-30 seconds and turn your computer on. (leave the
diskette in the drive)
d. Your computer will start using the information contained
on the diskette and will NOT START WINDOWS. You will be starting
the computer in DOS.
e. You will eventually see a prompt as follows:
f. Change to the AntiViral Toolkit Pro for DOS folder by typing
as follows if you installed using the default settings.
g. Now you will see
h. Now type:
avp.exe /- *:
will start AntiViral Toolkit Pro for DOS and automatically
detect and disinfect all found viruses.
i. Once the virus detection, disinfection is complete simply
remove the diskette and restart your computer.
NOTE! This virus may corrupt Winzip archives and leave them
in a state the in NOT repairable! You will need to replace
these files after disinfection.
advice is taken verbatim from a posting on alt.comp.virus
by Yuri Yanovich, of Central Comand Inc.(AVP), dated Tue,
10 Nov 1998 16:00:29 -0500