Flip
Flip
Type Multipartite virus
Creator
Date Discovered 1990.07
Place of Origin Germany
Source Language Assembly
Platform DOS
File Type(s) .exe, .com*
Infection Length 2,343 bytes
Reported Costs

The Flip virus is a multipartite virus from 1990. It has the interesting payload of flipping the screen horizontally.

Behavior

When Flip is introduced through an infected file, the virus checks if there is already a copy of itself in memory and that the memory is not full. If it is, the virus quits running. If not, it becomes memory resident. The virus then checks if the master boot record has been infected, and if it is not, infects it. The virus appends its code to any .com or .exe files that are executed. Files with an .ovl extension will also be infected if used by a file that becomes infected.

Flip is particularly interesting with regard to how it stores the rest of its master boot record code. Most boot sector viruses store their code in an area that it later marks as a bad sector. This virus modifies a part of the partition table that points to the physical limit of the disk, subtracting 6 from it and places its code in those six unreachable sectors. The first sector will be a modified but uninfected copy of the partition table.

It will not infect .com files that are over 62,856 bytes. The .com files that are infected will not infect any further files. When an infected .com file is run, the virus will be decrypted and a few instructions are executed, but control returns to the host program before the virus can infect anything. It will also not infect when executed from the boot sector.

On the second of any month between 16:00 and 16:59, it flips the display horizontally using a modified font that shows characters backwards. It will only work on monitors with EGA or VGA screens.

Code written to files will be encrypted, while code written to the master boot record is not.

Variants

Flip.Raistlin- formats disk sectors and displays the text "RAISTLIN I from Spain".

Other Variants

These are mostly similar to the original.

  • Flip.B
  • Flip.2153 (two other variants)
  • Flip.Prism

Other Facts

The Tequila virus is very similar to Flip. Some antivirus experts believe it may come from the same creator.

Sources

Jim Bates. The Virus Information Service, FLIP Virus. 1990.08

F-Secure Antivirus, F-Secure Virus Descriptions : Flip.

Kaspersky Lab. Virus List, Virus.Multi.Flip.2343.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License