Virus Profile: ALA

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 10/1/1989
Date Added: 10/15/1989
Origin: Israel
Length: 1,560 Bytes
Type: Virus
Subtype: File Infector
DAT Required: 4002
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

After the virus has been memory resident for one hour, the following message appears in a flashing box:

"SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW..............Box 1055 Tuscambia ALABAMA USA."

Total system and available free memory, as indicated by DOS CHKDSK are not altered. Infected files, have a file length increase of 1,560 bytes.

When a CTL-ALT-DEL combination is detected, the virus causes an apparent boot, but remains in RAM.

Its first known activation was on October 13, 1989. The virus is triggered on Fridays. On this day of the week, the virus manipulates the File Allocation Table (FAT) and begins to swap files.

Methods of Infection

The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.

Aliases

Alabama, Alabama-1560, Alabama.1560, Alabama.1560.a
   

Virus Characteristics

Alabama is a memory resident, file infecting virus. It infects .EXE files.

Upon infection, Alabama becomes memory resident, loading itself 30K under the highest memory location reported by DOS. Alabama hooks interrupts 09 and 21 in available free memory.

The Alabama virus uses a complex mechanism to determine whether or not to infect the current file. First, it checks to see if there is an uninfected file in the current directory, if there is one it infects it. If there are no uninfected files in the current directory, the file being executed is infected. However, sometimes instead of infecting the uninfected candidate file, it manipulates the File Allocation Table (FAT) to exchange the uninfected candidate file with the currently executed file without renaming it. The user, unaware of the swapping, believes that the file executing is the file which was selected when in effect, it is actually another file. The end result is that files are slowly lost on infected systems. This file swapping occurs when the virus activates on ANY Friday.

Additional Comments:
The Alabama virus was first isolated at Hebrew University in Israel by Ysrael Radai in October, 1989. Its first known activation was on October 13, 1989. The Alabama virus will infect .EXE files, increasing their size by 1,560 bytes. It installs itself memory resident when the first program infected with the virus is executed; however, it doesn't use the normal TSR function. Instead, this virus hooks interrupts 09 and 21 in available free memory. When a CTL-ALT-DEL combination is detected, the virus causes an apparent boot, but remains in RAM. The virus loads itself 30K under the highest memory location reported by DOS, and does not lower the amount of memory reported by the BIOS or by DOS. After the virus has been memory resident for one hour, the following message will appear in a flashing box: "SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW.............. Box 1055 Tuscambia ALABAMA USA." The Alabama virus uses a complex mechanism to determine whether or not to infect the current file. First, it checks to see if there is an uninfected file in the current directory, if there is one it infects it. Only if there are no uninfected files in the current directory is the program being executed infected. However, sometimes instead of infecting the uninfected candidate file, it will instead manipulate the FATs to exchange the uninfected candidate file with the currently executed file without renaming it, so the user ends up thinking he is executing one file when in effect he is actually executing another one. The end result is that files are slowly lost on infected systems. This file swapping occurs when the virus activates on ANY Friday.

   
All Users :
Script,Batch,Macro and non memory-resident:
Use current engine and DAT files for detection and removal.

PE,Trojan,Internet Worm and memory resident :
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:

SCANPM /ADL /CLEAN /ALL

Additional Windows ME/XP removal considerations


Users should not trust file icons, particularly when receiving files from others via P2P clients, IRC, email or other mediums where users can share files.

AVERT Recommended Updates :

* Office2000 Updates

* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch )

* scriptlet.typelib/Eyedog vulnerability patch

* Outlook as an email attachment security update

* Exchange 5.5 post SP3 Information Store Patch 5.5.2652.42 - this patch corrects detection issues with GroupShield

For a list of attachments blocked by the Outlook patch and a general FAQ, visit this link .
Additionally, Network Administrators can configure this update using an available tool - visit this link for more information .

It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.