Fandom

Malware Wiki

Ithaqua

1,319pages on
this wiki
Add New Page
Comments0 Share

Virus.Multi.Ithaqua or Ithaqua is a multipartite polymorphic DOS virus, written by Wintermute, a creator from the virus writing group 29A.

There are 4 variants:

  • Virus.Multi.Ithaqua
  • Virus.Multi.Ithaqua.8028
  • Virus.Multi.Ithaqua.8030
  • Virus.Multi.Ithaqua.12310

BehaviorEdit

The virus infects MBRs of hard disks and executables that are run. After infecting MBR the virus encrypts its contents so the logical disks are not accessible after booting from system diskette. The virus uses anti-debugging tricks, it is polymorphic in files as well as in infected MBR. The virus has many bugs and often corrupts files and MBR while infecting them.

The virus has quite a complex way of infection. It behaves differently under different DOS versions. Under DOS 7+ (Windows) the virus infects EXE files only and does not touch MBR and COM files. Upon infection the virus encrypts itself and writes its body to the end of infected files. The length of infected files increases by 8542 bytes.

Under DOS 6.22 and earlier DOS versions the virus infects any executable and also the MBR. MBR is infected when the first infected file is executed. While infecting EXE files the virus looks for 'cavities' (areas of constant data) 8030 bytes long and writes itself there. In this case the file length is not increased. When infecting COM files the virus writes itself to the end of the file. To get control when the infected file is executed, the virus either uses a standard method - puts a jump to its body to the beginning of infected program, or inserts a jump somewhere in the middle of the file. In the second case the virus uses simple encryption instead of its polymorphic engine. The length of infected file increases by 8,030 bytes.

Under DOS 6 the virus also uses emulator to get DOS INT 21h handler address, and modifies this address so that it points to virus INT 21h handler.

Payload Edit

On April 29th the virus sets graphics display mode, shows the below given text and imitates a snowfall.

[Ithaqua] virus by Wintermute/29A

Other details Edit

The virus contains the internal text strings:

I'm Ithaqua,... that who walks over the wind Welcome to my world, adventurer. Follow me. Love. Hate. I'll be awaiting you on the dark side, watching the nonsense.

VideosEdit

Virus.Multi.Ithaqua02:11

Virus.Multi.Ithaqua.8030

Ithaqua virus review by Alles Sandro

Virus.DOS05:38

Virus.DOS.Ithaqua

Ithaqua virus review by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.