Junkie | |
---|---|
Type | Multipartite virus |
Creator | Dr White |
Date Discovered | 1994.05 |
Place of Origin | Malmö, Sweden |
Source Language | |
Platform | DOS |
File Type(s) | .com |
Infection Length | 1,030 - 1,042 Bytes |
Reported Costs |
Junkie is a multipartite virus from Sweden. Like a few other viruses by that time, it caused more panic than any actual damage. It was coded by Dr. White in Sweden.
Behavior
When Junkie is run from an infected file, it infects the hard drive's master boot record. It becomes memory resident when booted from an infected hard drive, installing itself just below the 640k DOS boundary, where it takes up 3,072 bytes. The virus appends its code to .com and .exe files when they are executed or opened.
Junkie also infects diskette boot sectors when they are accessed. The virus copies itself to the last sector of the disk and writes code to the boot sector to point to it when the disk boots.
It contains the following encrypted text:
Dr White - Sweden 1994
Junkie Virus - Written in Malmo...M01D
Effects
The virus originated in Sweden and spread over western Europe. It made it to North America by August of 1994, first discovered in Ann Arbor, Michigan in the US. It was "accidentally" discovered when a sales representative for Reflex Inc. was presenting the company's antivirus product, Disknet. Given Junkie's ability to spread by piggybacking on antivirus programs, it is unknown if or how the sale went through.
Like Michelangelo and Datacrime before it, Junkie created a great deal of media hype. Some even went as far as to describe it as "the mother of all viruses". In reality, most of the virus's technologies (multipartite, encryption and polymorphism to name a few) were already at least three years old by the time of Junkie's release. It did not even have stealth capability.
Variants
There are two variants listed as Junkie.1029 and Junkie 1308. They are functionally similar to the original.
Origin
Junkie's code indicates it comes from Malmö, Sweden. It was first posted to European BBS's in May of 1994 in a .zip file named HV-PSPTC.ZIP. The post described the file contained in the .zip file, PSPATCH.COM, as being a pirated hacked version of a game. PSPATCH.COM really only contains the Junkie virus. Its creator, Dr White, is also responsible for the Desperado virus.
Sources
Patricia Hoffman. Online VSUM, Junkie Virus.
VIRUS-L Digest Volume 7 : Issue 46 New Super-virus "Junkie". 1994.06.30
Mike Lambert, Rochester Telephone Corporation. A Pile of Junk?.
Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Junkie.