💾 Archived View for spam.works › mirrors › textfiles › virus › malmsey.txt captured on 2023-06-16 at 21:03:26.
-=-=-=-=-=-=-
Virus Name: Malmsey
Aliases:
V Status: Rare
Discovered: October, 1992
Symptoms: .COM files overwritten; programs fail to function properly;
file date/time changes
Origin: Canada
Eff Length: 495 Bytes
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: Novi 1.15a+, F-Prot, VNet, Viruscan V99+, VBuster,
Sweep 2.43a+, IBMAV, AVTK 6.04+, NShld V99+, Sweep/N
Removal Instructions: Delete infected files
General Comments:
The Malmsey virus was received in October, 1992, and was written
by a person using the name Lucifer Messiah. Malmsey is from
Canada. This virus is a non-resident, direct action overwriting
virus which infects .COM programs, including COMMAND.COM. A
later version of the virus, Malmsey 2 described below, is a
parasitic, non-resident, direct action .EXE infector.
When a program infected with the Malmsey virus is executed, the
Malmsey virus will infect one .COM program located in the current
directory, overwriting the first 495 bytes of the host file. The
programs date and time in the DOS disk directory listing will have
been updated to the current system date and time when infection
occurred. The following text strings can be found in all Malmsey
infected programs:
"*.COM"
"[Malmsey Habitat v. 1.3]"
"Warmest Regards to RABID"
"from -- ANARKICK SYSTEMS!"
Malmsey doesn't appear to do anything besides replicate, though
infected programs will be permanently corrupted.
Known variant(s) of Malmsey are:
Malmsey 2: A later version of the Malmsey virus, this variant
infects one .EXE program each time an infected program
is executed. Infected programs will have a file length
increase of 1,703 to 1,717 bytes with the virus being
located at the end of the file. The Malmsey 2 virus
will occassionally reinfect previously infected
programs, adding an additional 1,712 bytes with each
reinfection. The file's date and time in the DOS disk
directory listing will not be altered. The following
text strings can be found in the viral code in Malmsey 2
infected programs:
"Malmsey Habitat v. 2.0"
"Lucifer Messiah -- ANARKICK SYSTEMS 07-18-"
"Hap Birthday !"
Origin: Canada October, 1992.
Malmsey 3 Beta: A later version of the Malmsey 2 virus, this
variant is a memory resident infector of .COM and .EXE
programs, including COMMAND.COM. It becomes memory
resident at the top of system memory but below the 640K
DOS boundary, hooking interrupts 3 and 21. Total system
and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 2,048 bytes. Once memory
resident, Malmsey 3 Beta infects .COM and .EXE programs
when executed. Infected programs will have a file length
increase of 806 bytes with the virus being located at the
end of the file. The file's date and time in the DOS disk
directory listing will not be altered. The following
following message may be displayed by the virus when an
infected program is executed:
"Gotcha!
[MALMSEY HABITAT v3.?]
Lucifer Messiah -- ANARKICK SYSTEMS"
These text strings are encrypted within the viral code.
Origin: Canada March, 1993.
??????????????????????????????????????????????????????????????????????????????