Date: 26 Sep 94 12:49:00 CST Subject: VIRUS1. The following was received by NASIRC (NASA Automated Systems Incident Response Capability.
NASIRC recently received notification of the discovery in the U.S. of a dangerous virus called "One_half", previously seen only in Europe, that damages files and encrypts the hard drive on DOS and Windows computers. The current versions of most virus scanners do not recognize/detect this virus (although new versions are expected shortly). One_half is capable of damaging all the files on an infected disk.
All systems running any version of MS-DOS, PC-DOS, DR-DOS, or Windows.
One_half was originally discovered in Europe in April 1994. It causes d amage in two ways. The first time an infected executable file is run, the virus loads itself into memory and attaches itself to all .COM and .EXE files on the system's hard drive. It then begins to encrypt the hard drive, potentially making all files in the encrypted cylinders unrecoverable if the virus is removed (see details below).
When an infected file is run, One_half attacks the hard drive's master boot record. It copies the original master boot record to a sector that is eight back from the end of the first track, then modifies the master boot record to run the virus code. The remainder of the virus code is placed in the last seven sectors of the first track on the hard disk.
One_half is intentionally damaging. Every time an infected machine is booted, the virus encrypts two cylinders of the hard drive's DOS partition, starting with the highest numbered cylinder and progressing to lower numbered ones. As long as One_half is in memory, this encryption is hidden from the user because the encrypted sectors are decrypted any time they are accessed by the system.
Symptoms of infection by the One_half virus:
WARNING--You must copy any important NON-EXECUTABLE files to floppy or tape *BEFORE* removing the virus from the system! Otherwise, the encryption key used by One_half will be lost when the virus is removed and your files will remain encrypted and unusable! (DO NOT copy any .COM or .EXE files, or you will simply be re-infecting your system.) DDI has made available a detection/removal utility called CNK_HALF. It must be run from a machine that was booted with a KNOWN, CLEAN, LOCKED floppy to insure that the virus is not in memory. When CHK_HALF is run, it scans the current drive and master boot record and removes any virus infections it finds. The utility does not scan memory first, and thus will NOT work correctly with the virus in memory, so be sure the system was booted from a clean, locked floppy. Also, the utility does *NOT* decrypt any encrypted cylinders, so be sure to copy any important files to floppy or tape BEFORE removing the virus, or they will be unusable!
CHEK_HALF.EXE is available from the NASIRC Anon FTP server at the URL:
ftp://nasirc.nasa.gov/home/kits/ftp/toolkits/DOS/chk_half.zipIf the above URL doesn't work, please read this
Remember that this file must be transferred in
Other anti-viral packages to combat One_half in the near future include:
NASIRC will continue to monitor this situation and will post additional information should it become necessary. If you have any questions about this bulletin, please contact NASIRC via any of the venues below.
NASIRC ACKNOWLEDGES: The Department of Energy's CIAC team for disseminating this information in a rapid and timely manner. Additional thanks go to Bill Kenny of DDI for spending his Labor day weekend laboring to write a detection/removal package for One_half.
For further assistance, please contact the NASIRC Helpdesk:
Phone: 1-800-7-NASIRC Fax: 1-301-441-1853 Internet Email: nasirc@nasa.gov 24 Hour/Emergency Pager: 1-800-759-7243/Pin:2023056 STU-III: 1-301-982-5480This bulletin may be forwarded without restriction to sites and system administrators within the NASA community. The NASIRC online archive system is available via anonymous ftp. You will be required to enter your valid e-mail address as the "password". Once on the system, you can access the following information:
~/bulletins ! contains NASIRC bulletins
~/information ! contains various informational files
~/training ! contains NASIRC course abstracts
~/toolkits ! contains automated toolkit software
The contents of these directories are updated on a continuous basis with relevant software and information; contact the NASIRC Helpdesk for more information or assistance.