ABRAXAS VIRUS

HISTORY

Abraxas, also known as Abraxas5, discovered in April 1993, is an encrypted, overwriting, file infecting computer virus which infects .COM and .EXE files, although it does not infect command.com. It does not become memory resident. Each time an infected file is executed, Abraxas infects the copy ofdosshell.com located in the C:\DOS directory (creating the file if it does not exist), as well as one EXE file in the current directory. Due to a bug in the virus, only the first EXE file in any directory is infected.

Abraxas-infected files will become 1,171 bytes in length and contain Abraxas' viral code. The file's date and time in the DOS disk directory listing will be set to the system date and time when infection occurred. The following text strings can be found within the viral code in all Abraxas infected programs:

"*.exe c:\dos\dosshell.com .. MS-DOS (c)1992"

"->>ABRAXAS-5<<--"

"...For he is not of this day"

"...Nor he of this mind"

Execution of infected programs will also result in the display of a graphic "ABRAXAS" on the system display, accompanied by an ascending scale being played on the system speaker.

Abraxas was created with the PS-MPC virus creation tool, which can be used to create similar, easily detected viruses, which are usually encrypted as well.

More than 20 viruses have appeared which have clearly been produced with the PS-MPC:

• 203 (computer virus)
• 644 (computer virus)
• Abraxas (computer virus)
• ARCV-n (computer virus) Remark: ARCV group has also produced viruses with the TPE and developed the ARCV strain.
• Joshua (computer virus)
• Kersplat (computer virus)
• McWhale (computer virus)
• Mimic (computer virus)
• Small ARCV (computer virus)
• Small EXE (computer virus)
• Swan Song (computer virus)

The name "Abraxas" was also was used for a virus in the video game Tron: Evolution.

CREATOR 

ARCV-n is a term for a large family of viruses authored by the ARCV groupthrough October - November 1992 and polymorphed with the PS-MPC virus generation tool (hence they are very similar). ARCV-n viruses seem to infectCOM (perhaps command.com) and/or EXE files rapidly, but do not damage the compromised machine, instead displaying various text messages to the user. An infected file will have the ARCV-n virus appended to the end of it.

ARCV-n family members

Member name	String contained	Trigger date	Extra behavior/displayed text
Arcv.335	[ARCV-6] Apache *.com
Arcv.339	[ARCV-5] Apache Warrior, ARCV. Pres.
Arcv.541	[ARCV-7] Apache ARCV. *.exe
Arcv.562	[X-1] ICE-9	March 3	ICE-9 Presents In Association with The ARcV [X-1] Michelangelo activates -< TOMORROW >-
Arcv.639	[ARCV93] ICE-9	January	Happy New Year from the ARCV Released 1 June 1992. Made in England by ICE-9
Arcv.651	[ARCV-3] Apache Warrior.	February	Yo.. I've Just Found a Virus.. Opps.. Sorry I'm the Virus. Well let me introduce myself.. I am ARCV-3 Virus, by Apache Warrior. Long Live The ARCV and Whats an Hard ECU? Vote Yes to the Best Vote ARCV..
Arcv.664	[ARCV-4] Apache Warrior, ARCV Pres. *.exe *.com	May 9	So Who's the Best Then? Oh Well Sorry But The ARCV Are The Best! Well Your in Favor with Us then.
Arcv.670	Made in ENGLAND. [ARCVXMAS] by ICE-9 Released June 1992.	December 20 until 25	Happy Xmas from The ARCV.
Arcv.679	Naughty, Naughtyall ARCV Productions Ltd. [ARCV-8] *.exe
Arcv.693	[ARCV-2] Apache Warrior, ARCV. Pres.	April	Help.. Help.. I'm Sinking........
Arcv.718	[SOLOMoN] ICE-9		Hello Dr Sol. & Fido. Lurve U lots ICE-9 (c) 1992 ARCV. P.S. Apache sez Hi(Dos)
Arcv.745	[ARCV-9] Apache Warrior. *.com
Arcv.773	[Slime] By Apache Warrior, ARCV Pres. Sliming around your PC, I go make a sticky MESS over your Hard Drive!
Arcv.795	[SCROLL] ICE-9 ARcV \COMMAND.COM		//scrolls up the screen
Arcv.795.b	[X-2] ICE-9, -< ARCV >- Made in England. Hi I'am called X-2, get my name right! Look out for the X-3 twins.
Arcv.826	[ARCV-1] Apache Warrior, ARCV Pres.	June 15	Long Live The ARCV. MUFC for the League! (c) Apache Warrior, ARCV Pres. 92 Welcome to the REAL World. And the ARCV 1 Virus!
Arcv.827	[ARCV-10] Apache Warrior.		Well its finally here The -= ARCV =- Welcome To our New Members..........
Arcv.839	[FRIENDS] i486X
Arcv.916	[JO] By Apache Warrior, ARCV Pres.	December 10	Looking Good Slimline Joanna. Made in England by Apache Warrior, ARCV Pres. Jo Ver. 1.11 (c) Apache Warrior 92. I Love You Joanna, Apache..
Arcv.916.b	JO Exerciser Virus.[citation needed]Apache Warrior, ARCV Pres. [JOEXE]
Arcv.965	[Joshua]		Guess what ??? You have been victimized by a virus!!! Do not try to reboot your computer or even turn it off. You might as well read this and weep!
Arcv.986	[JO] By Apache Warrior, ARCV Pres.		This is Dedicated To the Girl I Love, Joanna Dicks. Made in England by Apache Warrior, ARCV Pres. Jo Ver. 1.01 (c) Apache Warrior 92. I Love You Joanna, Apache..
Arcv.1060	[X-3b] ICE-9 (c) 1992 ICE-9 Written Oct 1992 Look out 4 future Releases		THE TWINS [X-3a] & [X-3b] ARE ON YOUR PC. ICE-9
Arcv.1072	[ReaperMan] Apache Warrior
Arcv.1172	[Sandwich] By Apache Warrior, ARCV Pres.		Which ARCV Member Likes a Sandwich? Cheese, Beef Spread, Cucumber and Crisp Corned Beef and Salad Cream Jaffa Cake and Hamster on Rye Is it A. Apache Warrior B. ICE-9 C. Slartibartfast Select a Letter: Well you know you're ARCV Members. Bad Luck.. Better Luck Next Time.
Arcv.1208	[SCYTHE] Apache Warrior, ARCV Pres.	December 12	This is the Scythe for Reaper Man. Beware I'm Sharp! Made in England by Apache Warrior, ARCV Pres. Scythe Ver. 1.01 (c) Apache Warrior 92. Reaper Man Swung The SCYTHE and the PC Died!