Grune

Classification

Malware

Virus

-

Grune

Summary

This destructive virus uses INT 21h/AX=4BCCh as an "Are-you-there" call. If this function return FCFEh, virus concludes that it is already resident. The virus installs itself by manipulating the Memory Control Blocks. DOS calls are used to install the resident INT 21h handler.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

The INT 21h handler defines the residence test and intercepts DOS function 4B00h (load/exec) to infect files. Files with an EXE header are excluded by testing for 'MZ' as the first word of the file. Files larger than 62.5 KB are also ignored. If a victim file start with a jump to a location of 1241 bytes before the end of the file, virus concludes that the file is already installed. File attribute is cleared and restored afterwards. File date/time are preserved. Infection is done by appending the virus.

Virus checks the system data. If the date is November 1991 or later and it is the 19th of an even-numbered month, a text message is decrypted (with XOR 0B5h). The message reads:

 Arbeiten Sie jetzt wirklich umweltfreundlich ?

 Sie haben nun viel Zeit dar ber nachzudenken !

 Es grsst Sie die "Grne Partei der Schweiz" !

The damage routine reads the disk system parameters (INT 13h/AH=8h) and the partition and boot sectors to get the disk parameters. All partitions on all hard disks have their system area overwritten with garbage from memory location 1000:0000h. Then the message is printed on the screen. When the message is displayed for the first time, data on disks is lost already.

Next each hard disk is completely overwritten (all sectors from beginning to end of physically formatted area) with the same garbage, and the message is printed once more for each disk. A maximum of 4 attempts are made at each disk operation.