F-Secure Virus Descriptions : X-Fungus

X-Fungus tests residence by issuing and INT 21h, AX=5432h. If the return value is 1004h, virus concludes that it is already resident.

Virus finds a suitable memory block to install itself in by following down the MCB chain and selects the block which is marked as last, or the last block before it exceeds the 640k limit, whichever is found first.

The virus reserves 2 KB by subtracting block size. The PSP next pointer is also adjusted. 1422 bytes of the viruscode is copied to the reserved memory area and execution continues in the copy. INT 21h and INT 08h handlers are installed by directly reading/writing the interrupt table.

The INT 21h handler defines the residence test, and intercepts the following DOS functions to infect files: 4Bh (load program), 43h (get/set attribute), 3Dh (open file), 56h (rename file), 6Ch (extended open/create).

Also DOS functions 1Ah (set DTA) is trapped so the DTA value can be stored (this code assumes that the setDTA call never fails), and functions 11h (FCB find first) and 12h (FCB find next) are trapped to conceal the increase in sizes of infected files. The virus subracts 1422 bytes from the filesizes of all infected files when they are looked at.

The infection routine flags the type of file depending on whether the given filename matches "*COM" or "*EXE" and ignores other files. "EXE" files which name begins with "SC" and COM files which name begins with "CO" are excluded from infection.

If the virus went resident on the 20th of September, the first 5 attempts at infecting files also write a message to the screen and wait 18 timer ticks. The message is 70 bytes long and encrypted with 8-bit NEG. It is reencrypted as soon as it has been used. Here is the message text:

        John Bonham - September 20, 1980
           - L E D   Z E P P E L I N -