Copy Link
Add to Bookmark
Report
Xine - issue #4 - Phile 006
/-----------------------------\
| Xine - issue #4 - Phile 006 |
\-----------------------------/
Ú--------------------------------------¿
| The history of Grog and his viruses |
| |
| Written by Dandler |
À--------------------------------------Ù
The virus-writer Grog appears on the Padanian and Italian virus scene in the
1992 and is active especially in the 1993, but not later.
In spite of his short activity, at the end of the 1993 Grog already produced
more than 50 viruses.
Still today the identity of this virus-writer is unknown and it seems that he
didn't further wrote any other virus, at least not using the name "Grog".
All his viruses were sent directly to a few antivirus researchers, maybe by
himself, by being uploaded in infected files, which were noticed as such, to
a Fidonet Bbs in Milan, in Lombardy, Padania, named "Euforia Bbs".
None of the Grog viruses has never been found in the wild nor has been found
in virus-trader's collections, so it is supposed that the only way of
distribution of his viruses was the Bbs one.
To be exact there is a known case of a Grog virus in the wild: there was an
infection of the virus Grog 3.1 in the United States somewhere in the 1996.
It is not known how wide the infection was, but it is probable that it
was originated by a copy of the virus that was downloaded from the Internet.
It is very unlikely that it was spreaded by the virus-writer since it took
place geographically very far and also 3 years after the virus was actually
written and distributed to the antivirus researchers.
The main peculiarity that is present in many Grog's viruses is the presence
in their body, sometimes displayed as payload sometimes not displayed, of
humoristic phrases from the Peanuts comics, from Snoopy's, Charlie Brown's
dog, attempts to write some popular novel that always turned out to be some
very funny failures. Also virus names are often taken from the Snoopy's novels
world and this made a small revolution in it's field. In fact if the
antivirus researchers were used to find magniloquent names like
"Dark Avenger", the arrival of this viruses with funny phrases gained
soon popularity.
Before the review of Grog's viruses I would like to express my regret for
the disappearing of this Padanian or Italian virus-writer, one of the most
promising and prolific ones. I hope the reason for his stop was a high
salary or a pretty girlfriend.
Now let's see Grog's viruses in alphabetical order:
- Aver torto (translation: to be wrong)
Year 1993. Com infector.
- Bruchetto (translation: little caterpillar)
Year 1993. Com infector. It inserts itself in the body of the file in an
area containing null bytes or characters.
- Char2grog
Year 1993. Com infector. It contains a payload that changes the system font
in text mode changing the character " " with word "Grog".
- Danzerino (translation: dancer)
Year 1993. Com infector.
- Delirious
Year 1993. It infects only the file "\command.com" on C and A drives.
- Dieta (translation: diet)
Year 1993. Exe infector.
- E-riluttanza (translation: E-reluctance)
Year 1992. Com infector.
- Enmity v1.0
Year 1993. Exe infector. Infects files by overwriting the Exe header but keeps
the program working.
- Enmity v2.0
Year 1993. Exe infector, Tsr. Infects files by overwriting the Exe header but
keeps the program working.
- Enmity v2.1
Year 1993. Exe infector, Encrypted, Infects files by overwriting the Exe header
but keeps the program working.
- Gonfievele (translation: swimmingly)
Year 1993. Com+Exe infector, Tsr. Uses 80286+ instructions.
- Grog v1.0
Year 1992. Com infector, a bit Polymorphic.
- Grog v2.0
Year 1992. Com infector, a bit Polymorphic.
- Grog v3.0
Year 1993. Com infector, Encrypted, Tsr. It has a payload that substitutes the
string "Microsoft" in memory with the string "Grog*Soft".
- Grog v3.1
Year 1993. Com infector, Encrypted, Tsr. It has a payload that substitutes the
string "Microsoft" in memory with the string "Grog*Soft".
- Grog v4.0
Year 1993. Com+Exe infector, Encrypted, Tsr. It uses various retro structures.
It tunnels Int 21h using a very interesting and complex tracing routine (at
the time it was the first virus to use such a tracing).
- Grog v5.0
Year 1993. The most advanced of the Grog family. Com+Exe infector, Encrypted,
Tsr. It uses many retro structures. It tunnels Int 21h with an even more
intelligent and complex tracing routine (at the time it was the first virus to
use such a tracing).
- Helen
Year 1993. Com+Exe infector, Tsr. Based on a Diamond source. It has the same
graphic payload as Diamond (available in AvpVE).
- Hophophop
Year 1993. Com infector. It inserts itself in the file's body in an area with
constant bytes. It writes to floppies directly using the Int 40h.
- Ildono (translation: thegift)
Year 1993. Com infector, Overwriting, partially Encrypted. It has a graphic
payload in 320x200 at 256 colors (available in AvpVE).
- Il cuoco (translation: the cook)
Year 1993. Exe infector, Tsr.
- Il mostro (translation: the monster)
Year 1993. Com infector.
- Inferno (translation: hell)
Year 1993. Boot infector. Maybe based on a Stoned source.
- Iraquiwarriorg
Year 1993. Com infector. Based on a Vienna source.
- Joe Anthro (translation: Joe Cave)
Year 1993. Com infector.
- Joelesquimese (translation: JoeEskimo)
Year 1993. Com infector, Polymorphic.
- Joemetafora (translation: Joemetaphor)
Year 1993. Com infector, Companion.
- Latraviata
Year 1993. Com infector.
- Lor
Year 1993. Com+Exe infector.
- Mi ami (translation: you love me)
Year 1993. Com infector, Encrypted.
- Mila
Year 1992. Com+Exe infector, overwriting. It has a payload that advertises
a radio transmission of the time named "Mila by night" broadcasted by the
Radio Deejay from Milan.
- Miscuglio (translation: mixture)
Year 1993. Com infector, Tsr. The included text reveals the origin of the
name "Grog" from the graphic adventure "Monkey Island", where the grog was
a disgusting drink for every human except for the pirates on the island.
- Mope
Year 1993. Com infector, Tsr.
- Mormorio (translation: whispering)
Year 1992. Com infector, overwriting.
- Napoleone (translation: Napoleon)
Year 1993. Exe infector, a bit Polymorphic.
- Nocciola (translation: Hazel-nut)
Year 1993. Com infector. The virus name is in Padania the name for the
Walt Disney's sorceress, Goofy's friend.
- Noncemale (translation: notsobad)
Year 1993. Com infector. Probably based on a Vienna source.
- Grog.Crackers.Inc
Year 1993. Com infector. The virus was able to execute a graphic effect when
an infected file was going to be cleaned by some old versions of TBClean from
the TBAV antivirus.
- Grog.Crackers.Nta
Year 1993. Com infector. The virus was able to execute a graphic effect when
an infected file was going to be cleaned by some old versions of TBClean from
the TBAV antivirus.
- Grog.Crackers.Public_enemy
Year 1993. Com infector.The virus was able to execute a graphic effect when
an infected file was going to be cleaned by some old versions of TBClean from
the TBAV antivirus.
- Grog.Crackers.Razor
Year 1993. Com infector.The virus was able to execute a graphic effect when
an infected file was going to be cleaned by some old versions of TBClean from
the TBAV antivirus.
- Grog.Crackers.The_dream_team
Year 1993. Com infector.The virus was able to execute a graphic effect when
an infected file was going to be cleaned by some old versions of TBClean from
the TBAV antivirus.
- Grog.Crackers.Wild_cards
Year 1993. Com infector.The virus was able to execute a graphic effect when
an infected file was going to be cleaned by some old versions of TBClean from
the TBAV antivirus.
- Gsav v1.0
Year 1993. Com infector. Full virus name: "Grog*Soft Antivirus v1.0".
Once infected a file the virus executes on the host an integrity check each
time it is executed. If the file has been changed, for example by an infection
of another virus, it will notice the user what happened and will give the
opportunity to restore the file as it was before the second infection.
- Gsav v1.1
Year 1993. Com+Exe infector. Full virus name: "Grog*Soft Antivirus v1.1".
Once infected a file the virus executes on the host an integrity check each
time it is executed. If the file has been changed, for example by an infection
of another virus, it will notice the user what happened and will give the
opportunity to restore the file as it was before the second infection.
- Outwit-c
Year 1993. Com infector, Encrypted. It has a graphic payload in 320x200 at 256
colors.
- Outwit-e
Year 1993. Exe infector, Encrypted. It has a graphic payload in 320x200 at 256
colors.
- Ovile (translation: sheep-fold)
Year 1993. Com+Exe infector, tsr. Based on a Murphy source.
- Sciagura (translation: misfortune)
Year 1993. Boot infector. Probably based on a Stoned source.
- Sempre (translation: always)
Year 1993. Com infector, Overwriting. Writes to floppies using the Int 40h.
- Stakka Bo (Stakka Bo was the name of a pop music group of the time)
Year 1993. Boot infector.
- Sway
Year 1993. Exe infector. It has a Tsr payload that uses the keyboard leds.
- Trofeodigolf (trophyofgolf)
Year 1993. Com infector. It has a payload that slowly overwrites the .dl files.
The Dl is a format for graphic animations developed in Milan.
- Trumpery
Year 1993. Com infector, Overwriting. It has a payload which tries to call
via modem some random numbers in the Milan area.
- Villino (translation: small country-house)
Year 1993. Com infector.
- End of file -
