Fax Free is a resident file virus, which infects EXE files which are either opened or executed. The virus is 1024 bytes long, of which 787 bytes are encrypted starting at offset 73. After every encryption or decryption virus compares one byte of its code with its unencrypted value. If this byte is wrong when expected right or right when expected wrong, the crypt loop is repeated (paranoid programming). Infected files contain the date when infection has happened.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
More scanning & removal options
More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Virus doesn't infect any files executed from floppy disk. Also, if the file begins with 'AN' or 'LD', it will not be infected. Before infecting any files, the virus calculates two bytes from the file code - if they add up to 255, virus considers the file is already infected and doesn't infect it. Virus infects files only if they're smaller than 512 kB.
Virus checks the system date when an infected file is executed. If the date equals to 25th or 26th of the month, the machine is crashed. Crashing the machine is done by filling 10 bytes of memory at 0000:0522 with 60h.
Virus contains two text messages. The first one is encrypted but the another one, 'Mosquito', is visible in infected files. The encrypted text says
Hello this is the core Rev 3 26/4/91 P 0.98c P. 0.98 Rev 4 24IX89 bye bye
Two variants, 1536 and 1024 bytes, which have not been analyzed yet.