Mange-Tout

Classification

Malware

Virus

DOS

-

Summary

The Mange-Tout virus was first found in Hong Kong at spring 1994. Soon after that, the virus was also discovered in China. The first European incident took place in August 1994, when a couple of VGA driver diskettes infected by Mange-Tout were discovered in Norway. The diskettes had been imported to Norway from Hong Kong, and the virus is believed to have spread elsewhere in Europe at the same time as well.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Mange-Tout has also been seen on some Cirrus CL5428 video card driver floppies, marked 'VGA MASTER, Utility diskette'. These files contained an infected INSTWIN.EXE. However, even though this file is infected, it can't spread the infection. This is because the original clean INSTWIN.EXE was not an executable even though it had an EXE extension.

Mange-Tout keeps itself encrypted all the time, even when it is resident in memory. When the virus is started, it decrypts itself by calling a complexly protected decryption routine. While in memory, Mange-Tout calls this routine when certain interrupt calls take place. The virus also contains traps for debug programs, and this makes it quite difficult to examine.

When Mange-Tout is resident in memory, it hijacks the interrupts 08h, 09h and 21h (clock, keyboard and DOS). It infects COM and EXE files which grow by 1099 bytes. Infection occurs every time a DIR command is issued; EXE files in the current directory are infected first. When all EXEs are infected, the virus starts to infect COM files as well.

The virus activates when a computer's keyboard has been left untouched for one hour. It tries to erase the computer's CMOS memory and main boot record, but fails more often than not and only manages to crash the computer.

The words Mange and Tout are French; the viruse's name can be roughly translated as 'omnivorous'. A 1091-byte-long variant of Mange-Tout is also known to exist.

F-Secure Ltd. has received several reports of infected preformatted diskettes in the Nordic countries during early 1995. Since the beginning of this year, several vendors have been found to have sold preformatted 3.5" diskettes which contained a file called DE.EXE. Since DE.EXE is actually a simple, German diskette formatting program, the file's existence on the diskettes is apparently due to a human error on the diskette factory. Unfortunately, on some of the diskettes this program has been infected by Mange-Tout.1099.

We have seen preformatted diskettes infected with boot sector viruses in the past, but the fact that Mange- Tout.1099 is a file virus makes the matter more serious; users seldom boot their computers from empty diskettes, but they may well find a file on a supposedly empty diskette intriguing, and run it just to find out what it does.

Date Created: -

Date Last Modified: -