Flip Virus

Virus Name: Flip Aliases: Flip-2343 V Status: Common Discovered: July 1990 Isolated: West Germany Symptoms: .COM & .EXE growth; decrease in system and free memory; boot sector and master boot sector altered; file allocation errors; possible hard disk corruption Origin: Switzerland Eff Length: 2,343 Bytes Type Code: PRhABKX - Parasitic Resident .COM, .EXE, Master Boot Sector Infector Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Flip, or Flip-2343, virus was discovered in West Germany in July 1990. It is a generic file infector, and will infect .COM, .EXE, and overlay files. This virus will also infect COMMAND.COM, as well as alter the master boot sector (partition table) and boot sector of hard disks. It is important to note that the Flip virus is not infective from .COM files or boot sectors. The first time an .EXE program infected with the Flip virus is executed, it installs itself memory resident in high memory. System memory as reported by the CHKDSK command as well as free memory will have decreased by 3,064 bytes. At this time, the copy of COMMAND.COM located in the C: drive root directory will be infected, though no file length change will be apparent with the virus in memory. The system's hard disk master boot sector and boot sector will also be slightly modified. If the infected program was executed from a floppy, COMMAND.COM on the floppy will be infected, though the size change will be noticeable. After Flip becomes memory resident, any .COM or .EXE files executed will become infected. Infected programs will show a file length increase of 2,343 bytes. If a program is executed which uses an overlay file, the overlay file will also become infected. Systems infected with Flip may experience file allocation errors resulting in file linkage errors. Some data files may become corrupted. On the second of any month, systems which were booted from an infected hard disk and have an EGA or VGA capable display adapter may experience the display on the system monitor being horizontally "flipped" between 16:00 and 16:59. Systems with hard disks which have been allocated with partitions greater than 32 megabytes in size may experience corruption of the hard disk logical partitioning. When this occurs, a partition larger than 32 megabytes may be altered to be slightly less than 32 megabytes in size. Flip can only be passed between systems on infected .EXE files. Infected .COM files, and altered floppy boot sectors do not transfer the virus. Known variant(s) of Flip are: Flip-2153: Similar to the original Flip virus, this variant has an effective length of 2,153 bytes. Its memory resident portion at the top of system memory is 2,672 bytes. The major difference between this variant and the original virus is that Flip-2153 can infect programs from the hard disk master boot sector infection. Origin: Unknown January, 1991. Flip-2153B: Similar to Flip-2153, this variant's major change is that the virus can now infect programs after becoming memory resident from an infected .COM program. Origin: United States October, 1991. Flip-2153C: Functionally similar to Flip-2153B, this variant has been altered to avoid detection by some anti-viral utilities. Origin: Unknown February, 1992. Flip-2343B: Functionally similar to the original Flip virus, this variant's size in memory is 2,864 bytes, hooking interrupt 21. Once the virus has become memory resident from an infected file, it is able to infect programs from both .COM and .EXE files without the system needing to be rebooted from the infected hard disk. Origin: Unknown September, 1992. Prism: Functionally similar to Flip-2153, this variant was altered to avoid detection by most anti-viral utilities which were aware of the Flip virus. Like Flip-2153, it adds 2,153 bytes to the .COM and .EXE programs it infects when they are executed. As with other members of this family, it also infects the hard disk master boot sector when the first infected program is executed. Origin: Unknown January, 1992. Raistlin: Functionally similar to Flip-2153B, this variant has been altered to avoid detection by some anti-viral utilities. Like Flip-2153B, it adds 2,153 bytes to the .COM and .EXE programs it infects on execution. The following text strings are encrypted within the viral code: "RAISTLIN I from Spain" "MADRID a favor del consumo de costo!" As with other Flip variants, this variant also infects the system hard disk master boot sector (which contains the hard disk partition table). Origin: Spain February, 1994.