Hare
Hare
Type Multipartite virus
Creator Demon Emperor
Date Discovered 1996.05
Place of Origin New Zealand
Source Language
Platform DOS
File Type(s) .com, .exe
Infection Length ~7,500 bytes
Reported Costs

Hare is a destructive polymorphic multipartite virus. It erases hard drives on certain days of the year.

Behavior

When a program infected with Hare is executed, the virus goes into memory just below the DOS 640k boundary, taking up 8,736 bytes. The virus then infects the master boot record. Hare infects .com and .exe files when they are executed or copied, adding around 7,500 bytes to the end of the file. It is polymorphic, so each infection may be a different size. The time and date of the virus will be mostly unchanged, except the seconds field will be set to "34". When the machine is rebooted, it infects floppy disk boot sectors.

Hare avoids infecting COMMAND.COM.

On August 22 or September 22, the virus delivers its payload. It overwrites all system hard disks and displays the message: ""HDEuthanasia" by Demon Emperor: Hare Krsna, hare, hare…"

Variants

There are a few vartiants of Hare, which differ only slightly in size and the text displayed by the virus. Hare.7750 and Hare.7772 display "HDEuthanasia-v2", but all the rest of the message is the same, and Hare.7786 and Hare.7808 are also the same, except it displays "HDEuthanasia-v3".

Effects

While sources seem to conflict with regard to exactly when Hare began spreading, it is generally agreed that it began in late spring or early summer of 1996 in New Zealand. After a short time, it made it to Canada and South Africa. Hare was found in the United States in May of 1996. It was known to have spread around the world, including to Britain, Switzerland, the Netherlands and Russia.

Name and Origin

Hare gets its name from the text the virus displays when its payload activates. This is a line from the Hare Krishna mantra, found in the Kali-Saṇṭāraṇa Upaniṣad, and associated with the International Society for Krishna Consciousness.

The creator likely intended the virus to be named "HDEuthanasia", as the text indicates. It has also gone by the names Krsna and HD Euthanasia, or some variation on those. Antivirus researchers are known to give viruses names that may irritate their creators (as was done most notably with with Bizatch) so it is likely that the most common name was "Hare", because when it is pronounced with a silent "e" and "a" as in "lake", it is a word for an animal similar in most respects to a rabbit.

The country of origin of Hare is uncertain. Some sources place its origin in New Zealand, while others claim it is from Slovenia, almost complete opposite ends of the globe. While the source that says New Zealand is from Patricia Hoffman's VSUM, which contains a few glaring mistakes in other places, it seems more likely that someone from New Zealand would be familiar with the Hare Krishna mantra, as Slovenia was only free from communism (and therefore had religious freedom) for 5 years at the time of the virus's release.

Sources

Patricia Hoffman. Online VSUM, Hare Virus.

Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Hare

Norton Antivirus, Hare.

Janet Kornblum. CNet News, New virus can be detected. 1996.08.12

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License