Byway is an extremely fast infector of COM and EXE files. It uses similar
methods with spreading as the old DIR-II virus family, but it employs a
novel technique. When the user executes an infected program in a clean
machine, the virus creates a hidden file called CHKLISTx.MSx in the root
directory (where "x" is ASCII-255, a fake space). When it infects a file
it changes the directory entries and crosslinks all executable files to
point to the CHKLISTx.MSx file, which in turn contains the virus code.
Microsoft Anti-Virus uses almost the same name for its checksum file,
apparently the virus author wanted to make the user believe that the
new file is the MSAV's file.
Byway exhibits both polymorphic and full stealth behavior. When the user
runs an infected program for the first time, the virus executes instead,
reserving 3216 bytes for itself. From this time on, all disk operations
are rerouted to the original files, resulting in their correct execution
and functioning. This way the virus hides quite successful from detection.
Byway employs an improved tunneling technique in order to bypass most
antivirus programs and integrity checkers. In fact it is able to defeat
most antivirus programs that use their "own file system" to scan files
and in turn, it infects the home directory of all scanned executable
files. This way the virus spreads very quickly through exposed machines.
The Byway.A variant contains the following encrypted texts:
In Byway.B variant, the second text is a bit different:
Byway activates on several dates after year 1996. The activation depends
on a parity check of a "generation counter" and a date triggered event:
(day of the month) = (((month's number)*2)+2)
For example 4th of January, 6th of February and 26th of December, so there
is a trigger date every month. When activated it displays a running text:
TRABAJEMOS TODOS POR VENEZUELA !!!
In english, this means "Let's all work for Venezuela". The text is
displayed on 3:00, 6:00, 9:00, 12:00, 15:00, 18:00 and 21:00 o'clock.
The virus also tries to play a tune through a sound card.
Byway is reported to be in the wild internationally, especially
in Venezuela, Mexico, Bulgaria, UK and USA.