Virus Name: Alabama
V Status: Endangered
Discovery: October, 1989
Symptoms: .EXE growth; resident (see text); message; FAT corruption
Eff Length: 1,560 bytes
Type Code: PRfET - Parasitic Resident .EXE infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: F-Prot, or delete infected files
The Alabama virus was first isolated at Hebrew University in Israel
by Ysrael Radai in October, 1989. Its first known activation was on
October 13, 1989. The Alabama virus will infect .EXE files,
increasing their size by 1,560 bytes. It installs itself memory
resident when the first program infected with the virus is executed;
however, it doesn't use the normal TSR function. Instead, this
virus hooks interrupts 09 and 21 in available free memory.
When a CTL-ALT-DEL combination is detected, the virus causes an
apparent boot, but remains in RAM. The virus loads itself 30K under
the highest memory location reported by DOS, and does not lower the
amount of memory reported by the BIOS or by DOS.
After the virus has been memory resident for one hour, the following
message will appear in a flashing box:
"SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW..............
Box 1055 Tuscambia ALABAMA USA."
The Alabama virus uses a complex mechanism to determine whether or
not to infect the current file. First, it checks to see if there is
an uninfected file in the current directory, if there is one it
infects it. Only if there are no uninfected files in the current
directory is the program being executed infected. However,
sometimes instead of infecting the uninfected candidate file, it
will instead manipulate the FATs to exchange the uninfected
candidate file with the currently executed file without renaming it,
so the user ends up thinking he is executing one file when in effect
he is actually executing another one. The end result is that files
are slowly lost on infected systems. This file swapping occurs when
the virus activates on ANY Friday.