Blue Nine Virus
Virus Name: Blue Nine
Aliases: Blue Nine.925.A
V Status: New
Discovery: January, 1996
Symptoms: .COM file growth; file date/time seconds = "04";
decrease in available free memory;
DOS CHKDSK file allocation errors;
unexpected system reboots
Eff Length: 925 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, PCScan,
AVTK/N, IBMAV/N, NShld, NAV/N, Innoc
Removal Instructions: Delete infected files
The Blue Nine or Blue Nine.925.A virus was received in January,
1996. Its origin or point of isolation is unknown. Blue Nine
is a memory resident stealth type virus which infects .COM files,
including COMMAND.COM. It does not infect very small .COM files.
When the first Blue Nine infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program from
DOS 5.0, will have decreased by 960 bytes. Interrupt 21 will be
hooked by the virus in memory.
Once memory resident, the Blue Nine virus will infect .COM files,
including COMMAND.COM, when they are executed. Infected files will
have a file length increase of 925 bytes, though this file length
increase will be hidden when the virus is memory resident. The
virus will be located at the end of the file. The program's date
and time in the DOS disk directory listing will not appear to be
altered, though the seconds field will have been set to "04", the
infection marker for the virus. The following text string is
visible within the viral code:
"- Blue Nine Virus by Conzouler 1994 -"
The virus is not visible within infected files when this virus is
memory resident as the virus disinfects the program as it is read
into memory, thus its classification as a stealth virus.
The DOS CHKDSK program will indicate file allocation errors on all
infected files when this virus is memory resident. Blue Nine.925.A
will also set the file date/time seconds to "04" on any .COM file,
even the very small .COM files it does not infect. As a result,
some .COM files may appear to have drasticly increased in size or
be 925 bytes smaller in the DOS disk directory listing when the virus
is memory resident.
Known variant(s) of Blue Nine are:
Blue Nine.925.B: Also received in January, 1996, this is a
very minor variant, and is functionally similar to the origin
Origin: Unknown January, 1996.