Mange-Tout

Classification

Category:

Malware

Platform:

DOS

Type:

Virus

Aliases:

Summary

The Mange-Tout virus was first found in Hong Kong at spring 1994. Soon after that, the virus was also discovered in China. The first European incident took place in August 1994, when a couple of VGA driver diskettes infected by Mange-Tout were discovered in Norway. The diskettes had been imported to Norway from Hong Kong, and the virus is believed to have spread elsewhere in Europe at the same time as well.

Removal

Technical Details

Mange-Tout has also been seen on some Cirrus CL5428 video card driver floppies, marked 'VGA MASTER, Utility diskette'. These files contained an infected INSTWIN.EXE. However, even though this file is infected, it can't spread the infection. This is because the original clean INSTWIN.EXE was not an executable even though it had an EXE extension.

Mange-Tout keeps itself encrypted all the time, even when it is resident in memory. When the virus is started, it decrypts itself by calling a complexly protected decryption routine. While in memory, Mange-Tout calls this routine when certain interrupt calls take place. The virus also contains traps for debug programs, and this makes it quite difficult to examine.

When Mange-Tout is resident in memory, it hijacks the interrupts 08h, 09h and 21h (clock, keyboard and DOS). It infects COM and EXE files which grow by 1099 bytes. Infection occurs every time a DIR command is issued; EXE files in the current directory are infected first. When all EXEs are infected, the virus starts to infect COM files as well.

The virus activates when a computer's keyboard has been left untouched for one hour. It tries to erase the computer's CMOS memory and main boot record, but fails more often than not and only manages to crash the computer.

The words Mange and Tout are French; the viruse's name can be roughly translated as 'omnivorous'. A 1091-byte-long variant of Mange-Tout is also known to exist.

F-Secure Ltd. has received several reports of infected preformatted diskettes in the Nordic countries during early 1995. Since the beginning of this year, several vendors have been found to have sold preformatted 3.5" diskettes which contained a file called DE.EXE. Since DE.EXE is actually a simple, German diskette formatting program, the file's existence on the diskettes is apparently due to a human error on the diskette factory. Unfortunately, on some of the diskettes this program has been infected by Mange-Tout.1099.

We have seen preformatted diskettes infected with boot sector viruses in the past, but the fact that Mange- Tout.1099 is a file virus makes the matter more serious; users seldom boot their computers from empty diskettes, but they may well find a file on a supposedly empty diskette intriguing, and run it just to find out what it does.