virus - Page 1

A popular brand of calculators is being infected by a new virus that causes screens to read, "t89.GARRA."

ADVERTISEMENT The virus, which attacks Texas Instruments TI89 and compatible calculators, doesn't do any permanent harm, but Texas Instruments engineers haven't found a way to disable it either. And while the author of the virus has been charitable enough to include code for disabling it, researchers have not been able to validate that fix.

TIOS.Tiagra, as it has been dubbed by researchers at Symantec, cannot spread without use of a USB cable.

The virus works by appending its code to any suitable file, and searches for a particular instruction sequence to replace and point towards the virus code. If the sequence is not found, the virus will remain but will not gain control, according to Symantec security researchers.

The virus only runs on files with ASM extensions, so, in order to propagate itself, it has to run a check on the calculator for ASM-type files; moreover, it cannot infect previously infected files, Symantec officials said in an advisory.



ASM is a filename extension for assembly language source programs. When successfully launched, the virus clears the calculator's screen and presents a message that reads: t89.GARRA. According to the advisory, the calculator will resume normal operations once infection is complete.

"To our knowledge, there is no damage caused," said Javier Santoyo, manager of development at Symantec. "There is a payload that executes only very rarely; if an infected file is executed at a specific moment in time, then a message will be displayed, after which the calculator remains fully functional."

Symantec has rated the threat posed by the virus as "low." The virus can only spread if it is shared between users via a USB cable, Santoyo said.

"Because we have no on-calculator scanner, we are not entirely sure how to detect and remove the virus," he said. "Detection could be done by extracting files to the desktop and scanning them, but that's not really viable. The virus author wrote a repair routine that can run on the calculator, but we haven't checked that it works."

(http://www.eweek.com/article2/0,1759,2141590,00.asp)

It seems that the virus author did not realise that the relocation table is always properly aligned, so copying it can be done in just two instructions instead of 11.

Thibaut (./8) :
Pourquoi il s'insère dans la machine seulement si l'on possède un câble USB ?

nEUrOO (./11) :
hercheurs en secu? tu veux dier createur de virus je crois...
c'est pas du tout pareil

nEUrOO (./11) :
Et c'est leur boulot... essayer de couvrir le max