F-Secure Virus Descriptions : Tai-Pan

NAME:	Tai-Pan
ALIAS:	Whisper
TYPE:	Resident EXE-files
SIZE:	438
ORIGIN:	Sweden

Tai-Pan.438.A was first discovered in Sweden during the summer 1994. It has since spread to Europe, USA, Canada and also New Zealand.

Tai-Pan is quite a simple virus. It stays resident in memory and infects nearly all executed EXE files. It will not infect files that are larger than 64kB. Infected files grow by 438 bytes. Tai-Pan does not do anything apart from spreading itself, but it will make the infected machine unstable.

Tai-Pan is also known as Whisper. This is due to the text it contains '[Whisper presenterar Tai-Pan]'.

VARIANT: Tai-Pan.666

ALIAS: DOOM_II_Death, D2D

SIZE: 666

This minor variant was found from Belgium in November 1994. After that it has been found in at least Scandinavia and Canada.

It contains the following text strings:

  DOOM2.EXE
  Illegal DOOM II signature
  Your version of DOOM2.EXE matches the illegal RAZOR release of DOOM2
  Say bye-bye HD
  The programmer of DOOM II DEATH is in no way affiliated with ID software.
  ID software is in no way affiliated with DOOM II DEATH.

Despite the above text, Tai-Pan.666 never activates. It just spreads.

VARIANT: Tai-Pan.434

SIZE: 434

This is a minor variant of the original 438 byte version. It contains the text "CoSmO".

VARIANT: Tai-Pan.513

ALIAS: Hooze

SIZE: 513

This variant got widespread during the Assembly'96 party in August 1996, as it was attached to a version of a demo called STROKE.EXE.

This version is pretty much like the original Tai-Pan (it infects only small EXE files), except it has an activation routine. On the 5th of August the virus starts to rabidly flash the screen colors between black and white (strobo-effect). This is done in the background.

The virus contains this text:

        [Hooze Virus 1.0 (Tai-Pan clone)]

[Analysis: Mikko Hypponen, F-Secure]