Avalanche Virus

Virus Name: Avalanche Aliases: Avalanche.2818 V Status: New Discovery: July, 1995 Symptoms: .COM & .EXE growth; DOS CHKDSK file allocation errors; decrease in available free memory; may delete some anti-viral programs when executed; file date/time years altered Origin: Germany Eff Length: 2,818 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: NAV, NAVDX, ViruScan, IBMAV, VAlert, AVTK, F-Prot, ChAV, AVTK/N, NAV/N, IBMAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Avalanche or Avalanche.2818 virus was received in July, 1995, and appears to be from Germany. Avalanche is a memory resident stealth virus which infects .COM and .EXE files, including COMMAND.COM. When the first Avalanche infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 3,456 bytes. Interrupts 13 and 21 will be hooked by the virus in memory. Once the Avalanche virus is memory resident, it will infect .COM and .EXE files, including COMMAND.COM, when they are executed. Infected files will have a file length increase of 2,818 bytes, though this file length increase will be hidden by the virus when it is memory resident. The virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the year field will have been altered by 100 years. The following text strings are encrypted within the viral code: "AVALANCHE/Germany '94...Metal Junkie greets Neurobasher" "*.com" "F-PR TBAV SCAN MSAV CPAV TBME TBFI TBSC VIRS TBDR" With this virus memory resident, if the system user attempts to execute any program starting with one of the four character strings indicated in the last text string above, the virus will delete the program from disk. Attempts to view infected files with the virus memory resident will result in an uninfected copy of the program being displayed. The DOS CHKDSK program will indicate file allocation errors on all infected files. Known variant(s) of Avalanche are: Avalanche.2831: Also received in July, 1995, this is a 2,831 byte variant of the Avalanche virus described above. Its size in memory is 3,472 bytes, hooking interrupts 13 and 21. It adds 2,831 bytes to the .COM and .EXE files it infects, including COMMAND.COM. Like the original virus, it is a full stealth virus. The same text strings are encrypted within the viral code as in the original virus. This variant also deletes some anti-viral programs when the user attempts to execute them with the virus memory resident. Origin: Germany July, 1995.