Baclab Virus


 Virus Name:  Baclab 
 Aliases:     Baclab.2138, Crawber.2138, NTU.T4 
 V Status:    In The Wild 
 Discovery:   July, 1996 
 Symptoms:    .EXE file growth; decrease in available free memory; 
              DOS CHKDSK file allocation errors; 
              file date/time seconds = "30" 
 Origin:      Unknown 
 Eff Length:  2,138 - 2,152 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, PCScan, 
                    NAV, NAVDX, ChAV, 
                    Innoc, NProt, AVTK/N, IBMAV/N, LProt, 
                    NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Baclab, Baclab, Crawber.2138, or NTU.T4 virus was received in 
       July, 1996.  Its origin or point of isolation is unknown.  This 
       virus has been reported to be "in the wild" by several anti-viral 
       researchers as of July, 1996.  Baclab is a memory resident, size 
       stealthing virus which infects .EXE files, though not very small 
       ones. 
 
       When the first Baclab infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Available 
       free memory, as indicated by the DOS CHKDSK program from DOS 5.0, 
       will have decreased by 2,560 bytes.  No interrupts will be mapped 
       by memory mapping utilities to the virus in memory. 
 
       Once the Baclab virus is memory resident, it will infect .EXE files 
       when they are executed.  Infected files will have a file length 
       increase of 2,138 to 2,152 bytes with the virus being located at 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will not appear to be altered, though the seconds 
       field will have been set to "30".  The following text strings are 
       encrypted within the viral code: 
 
           "T4 virion ------- by NTU BACTERIOPHAGE LAB" 
           "There Once Was A King, Who Called For The Spring" 
           "For His World Was Still Covered In Snow" 
           "But The Spring Had Not Been, For He Was Wicked And Mean ..." 
           "Here I'm Sitting And It's Getting Cold" 
           "The Morning Rains Against My Window Pane" 
           "While The World Looks So Cold And Grey" 
           "In My Mind I Dream Away" 
           "Then I'm On My Way To Tropic Islands" 
           "You'd Always Say I Was A Dreamer" 
           "You Were Right" 
           "What Do I Say When It's All Over ?" 
           "And SORRY Seems To Be The Hardest Word ..." 
 
       It is unknown what the Baclab virus does besides replicate. 

Show viruses from discovered during that infect .

Main Page