
                               Eugene Kaspersky and  Vadim  Bogdanov


                                                     
Aliases:        VolGU

Type:           Resident, Master Boot Sector

Self-Recognition:

   Disk         Text String at the beginning of MBS
                Varies for different variants.

   System       Varies for different variants.

Hex Pattern:    Positioned at offset 0 of sector 0

   Volga-A:     BE00 7C33 FFFA 8ED7 8BE6 FB9A 3000 C007
   Volga-B:     BE00 7C33 FFFA 8ED7 8BE6 FBEA 3A00 C007
   Volga-C:     BE00 7C33 FFFA 8ED7 8BE6 FBEA 3000 C007
   Volga-D:     BE00 7C33 FFFA 8ED7 8BE6 FBEA 3000 C007
   Volga-E:     BE00 7C33 FFFA 8ED7 8BE6 FBEA 2901 C007
   Volga-F:     BE00 7C33 FFFA 8ED7 8BE6 FBEA 3301 C007

Intercepts:     INT 13h for infection and damage

Trigger:        Rewrites Sectors on the hard disk drive
                using the INT 1 3h 'write long sector'
                request, making sectors  unavailable
                when the virus is not memory-resident.

Removal:        Specific and generic removalis pos-
                sible under clean system conditions.




The Volga Virus Family

The vast majority of all virus trigger routines simply involve
either displaying a silly message, overwriting the hard drive
or both. Indeed, while virus authors seem to spend a great of
time thinking of new  ways to infect a system, little thought
ever seems to be given to the trigger routine, which is the
virus' raison d'etre. Unfortunately the Volga virus family is
an exception to this rule.

The family consists of several variants which are all related
to the New Zealand II virus. They were discovered in the
Volgograd State University in Russia, and are internally
dated from July 1991 to the end of April 1992. All of the
members of the Volga family occupy one disk sector, and
take up one or two Kilobytes of memory  when resident.


Operation

There is nothing paricularly novel about the way the Volga
virnses replicate. When a machine is booted from an infected
hard or floppy drive, the virus installs itself into high
addresses of system  memory, then checks the hard disk
Master Boot Record to see whether it is infected.

If the hard disk is not infected, the virus uses a standard boot
sector virus infection routine. The original contents ofthe
                    
drives. None of this is paricularly noteworthy, however the
Volga family of viruses is interesting because of an unusual
(and extremely annoying) trigger routine.
 

Destructive Trigger

All the viruses in the Volga family have the unfortunate side-
effect that once a PC is infected, it is very difficult to recover
the information stored on the drive. Even after the virus has
heen removed from the machine, a further clean-up prece-
dure is required to restore normal functionality.

The virus author uses the fact that the fixed disk contreller
stores a error correction code (ussually four or six bytes in
length) at the end of every sector. The disk controller uses
this information for error checking and error correction of the
data stored within that sector.

If the extra information stored at the end of a sector is not
what the disk controller expects, then an error code is
returned, and the read request fails. However, IBM  was
prepared for this eventuality and implemented a call which
allows software to read the entire contents of a sector,
including this extra information.

When one of the Vo1ga Viruses is resident, it intercepts calls
to lNT 13h and substitutes the two calls

       INT 13h,  AH=02h  read disk sector(s) 
       INT 13h,  AH=03h  write disk sector(s)

with

       INT 13h,  AH=0Ah  read long hard disk sector(s)
       INT 13h,  AH=0Bh  write long hard disk sector(s)

These substituted calls use exactly the same registers and
return the same values, so no additional programming needs
to be done to ensure that the read long calls function cor-
rectly. However, this is a process fraught with potential
pitfalls. The IBM  BIOS Interface Technical Reference
Manual states that  services 0Ah and 0Bh are 'reserved for
diagnostics' , and that these calls should be used with care.
                                              
                                              
The Trigger in Action

Therefore when an INT 13h write request is issued, the virus
intercepts the call and changes it into a 'write long sector'
call. As discussed above, this means that the sector is no
longer readable by standard calls to the BIOS.

However, when the virus is memory-resident, all read
requests (INT 13h, AH=02h) are altered to  read long sector'
requests (INT 13h, AH=0Ah). This 'read long sector' call
will read not only seetors which have been altered by the
virus, but sectors which have been written by DOS in the
standard format. As long as the virus is memory-resident the
computer will appear to operate normally.

The catch is that if the hard disk is accessed without the
virus memory-resident (either after clean booting or after the
machine has been disinfected) the standard DOS  functions
will not be capable of reading the rewritten long sectors.
This occurs because the standard INT l 3h call cannot read
these altered sectors correctly.


Cleaning Up

Even though it is relatively easy to disinfect machines
infected with these viruses, recovering the data stored on
affected hard drives is a tricky task, best carried out by a
program  written specially for that pupose. This program has
to read all sectors on the hard drive, and, if it encounters an
error, attempt to use the 'read long sector' function call. If
this call is successful, the sector should be rewritten using
the standard write sector call.

As the only way to test if a sector is affected is to read data
from it, this procedure can take a lot of time to complete -
from several minutes to an hour, depending on hard disk size
and speed. This makes the Volga family of viruses one of the
most difficult from  which to recover.

Although the trigger routine should not cause data loss, the
time taken to recover data from  the hard drive classes it as
one of the most irritating viruses in the wild. One can only
hope that the last virus in the Volga series marks its author' s
last attempt at virus writing.

                                                   

