The Mange-Tout virus was first found in Hong Kong at spring
1994. Soon after that, the virus was also discovered in
China. The first European incident took place in August
1994, when a couple of VGA driver diskettes infected by
Mange-Tout were discovered in Norway. The diskettes had been
imported to Norway from Hong Kong, and the virus is believed
to have spread elsewhere in Europe at the same time as well.
Mange-Tout has also been seen on some Cirrus CL5428 video card
driver floppies, marked 'VGA MASTER, Utility diskette'. These
files contained an infected INSTWIN.EXE. However, even though
this file is infected, it can't spread the infection. This is
because the original clean INSTWIN.EXE was not an executable even
though it had an EXE extension.
Mange-Tout keeps itself encrypted all the time, even when it
is resident in memory. When the virus is started, it
decrypts itself by calling a complexly protected decryption
routine. While in memory, Mange-Tout calls this routine when
certain interrupt calls take place. The virus also contains
traps for debug programs, and this makes it quite difficult
to examine.
When Mange-Tout is resident in memory, it hijacks the
interrupts 08h, 09h and 21h (clock, keyboard and DOS). It
infects COM and EXE files which grow by 1099 bytes. Infection
occurs every time a DIR command is issued; EXE files in the
current directory are infected first. When all EXEs are infected,
the virus starts to infect COM files as well.
The virus activates when a computer's keyboard has been left
untouched for one hour. It tries to erase the computer's
CMOS memory and main boot record, but fails more often than
not and only manages to crash the computer.
The words Mange and Tout are French; the viruse's name can
be roughly translated as 'omnivorous'. A 1091-byte-long
variant of Mange-Tout is also known to exist.
F-Secure Ltd. has received several reports of infected
preformatted diskettes in the Nordic countries during early 1995.
Since the beginning of this year, several vendors have been found
to have sold preformatted 3.5" diskettes which contained a file
called DE.EXE. Since DE.EXE is actually a simple, German diskette
formatting program, the file's existence on the diskettes is
apparently due to a human error on the diskette factory.
Unfortunately, on some of the diskettes this program has been
infected by Mange-Tout.1099.
We have seen preformatted diskettes infected with boot
sector viruses in the past, but the fact that Mange-
Tout.1099 is a file virus makes the matter more serious;
users seldom boot their computers from empty diskettes, but
they may well find a file on a supposedly empty diskette
intriguing, and run it just to find out what it does.
