The Mange-Tout virus was first found in Hong Kong at spring 1994. Soon after that, the virus was also discovered in China. The first European incident took place in August 1994, when a couple of VGA driver diskettes infected by Mange-Tout were discovered in Norway. The diskettes had been imported to Norway from Hong Kong, and the virus is believed to have spread elsewhere in Europe at the same time as well.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Mange-Tout has also been seen on some Cirrus CL5428 video card driver floppies, marked 'VGA MASTER, Utility diskette'. These files contained an infected INSTWIN.EXE. However, even though this file is infected, it can't spread the infection. This is because the original clean INSTWIN.EXE was not an executable even though it had an EXE extension.
Mange-Tout keeps itself encrypted all the time, even when it is resident in memory. When the virus is started, it decrypts itself by calling a complexly protected decryption routine. While in memory, Mange-Tout calls this routine when certain interrupt calls take place. The virus also contains traps for debug programs, and this makes it quite difficult to examine.
When Mange-Tout is resident in memory, it hijacks the interrupts 08h, 09h and 21h (clock, keyboard and DOS). It infects COM and EXE files which grow by 1099 bytes. Infection occurs every time a DIR command is issued; EXE files in the current directory are infected first. When all EXEs are infected, the virus starts to infect COM files as well.
The virus activates when a computer's keyboard has been left untouched for one hour. It tries to erase the computer's CMOS memory and main boot record, but fails more often than not and only manages to crash the computer.
The words Mange and Tout are French; the viruse's name can be roughly translated as 'omnivorous'. A 1091-byte-long variant of Mange-Tout is also known to exist.
F-Secure Ltd. has received several reports of infected preformatted diskettes in the Nordic countries during early 1995. Since the beginning of this year, several vendors have been found to have sold preformatted 3.5" diskettes which contained a file called DE.EXE. Since DE.EXE is actually a simple, German diskette formatting program, the file's existence on the diskettes is apparently due to a human error on the diskette factory. Unfortunately, on some of the diskettes this program has been infected by Mange-Tout.1099.
We have seen preformatted diskettes infected with boot sector viruses in the past, but the fact that Mange- Tout.1099 is a file virus makes the matter more serious; users seldom boot their computers from empty diskettes, but they may well find a file on a supposedly empty diskette intriguing, and run it just to find out what it does.