Parvo

Parvo
Type	File virus
Creator	GriYo
Date Discovered	1999
Place of Origin	Spain
Source Language	Assembly
Platform	MS Windows
File Type(s)	.exe
Infection Length	13,794 bytes

Parvo is a polymorphic 32-bit Windows virus by GriYo of 29A. One of Parvo's more interesting features was its ability to send files through email. Its polymorphism was very similar to his previous Marburg virus.

Behavior

Execution

When a file infected with Parvo is executed, the virus decrypts itself using both a polymorphic decryption loop and an addition light decryption routine. The virus protects its code with a cyclical redundancy check (CRC). It calculates the CRC of its code and exits if it is not correct. This likely prevents the spread of corrupted versions, especially those sent over the Internet.

The virus scans the kernel for API functions it can use such as file search and access. It uses the checksums of the API functions rather than their names. To find necessary string in Windows kernel the virus just calculates their CRCs one-by-one and compares the results with a table of pre-calculated values that are saved in virus code.

Infection

Parvo searches for infectable files in the Windows and Windows system directories. It also checks the registry to find directories containing the Internet browser and email reader. It infects only files with the following names: IEXPLORE.EXE, INSTALL.EXE, NETSCAPE.EXE, NOTEPAD.EXE, SETUP.EXE, WINZIP32.EXE, and a few others. It also uses a checksum method similar to searching for the API functons.

When returning control to the host program, Parvo makes a copy of the file in uninfected form under a randomly-selected name and executes it. The virus stays in memory while it waits for the host program to terminate. As it does not hook any events or intercept any file execution or opening, so it is not considered a memory resident virus, though it may stay in memory for a long time.

Parvo appends itself to the end of the last file section. It does not modify PE entry address but patches the original program’s entry code with JMP_Virus instruction, or with a block of junk code that at the end passes the control to virus.

Email

Parvo has two routines requiring internet access. It connects to the Internet using standard Windows functions. The virus looks for email addresses on several newsgroups, selects a random message and gets a target address from the "FROM:" line. The attachment name will be randomly selected from one of the following: MSEFIXI.EXE, LSERIAL.EXE or HOTEENS.EXE. The messages will also be randomly selected from one of the following:

Message 1

from: [e-mail]
Subject: Present security risk using Microsoft Internet Explorer and
Outlook Express

A new and dangerous virus has hit the Internet.

DESCRIPTION:

When the email client receives a malicious mail or news message that
contains an attachment with a very long filename, it could cause the
email to execute arbitrary code automaticly on the client workstation,
thus infecting the machine.

Microsoft has been aware of this problem from the very beginning and
presents here a patch for the two of our products in which it exploits.

Outlook 98 on Windows � 95, Windows 98 and Microsoft Windows NT � 4.0
Outlook Express 4.0, 4.01 (including 4.01 with Service Pack 1) on
Windows 95, Windows 98 and Windows NT 4.0
Netscape Mail Clients

SOLUTION:

Customers using this products for Windows 95, Windows 98 or Windows NT
4.0 should execute the attached patch or download an updated patch
from:

http://www.microsoft.com/outlook/enhancements/outptch2.asp

Please patch your computer(s) as soon as possible and help us fight this
threat to the Internet.

Thank for your time.

Microsoft Support

Message 2

from:
Subject: New and even larger serial number list out now!

Hi

Do you need a serial number for a unregistrated program of yours?

Do you feel like you have looked for it everywhere?

Even in the newest version of Phrozen Crews Oscar?

If you can answer -yes- to some of the above questions and are still
looking for a serial number, this might be the program you have been
waiting for.

We have collected serial numbers for many years and are now proud to
release the very first version of our serial number collection, which
contains more than 15.000 serial numbers.

Attached to this message is the very first version of our serial number
collection.

Yours,
Serial number collectors

Message 3

from:
Subject: New and 100% free XXX site

Dear potential customer,

We have just opened a new erotic site with more than 10.000 .JPGs and more
than 1.000 .MPG/.VIV/.AVI/.MOV/etc.

We offer you the opportunity of a lifetime, we are giving away a months
access, without being charged, to our new site in exchange for your
opinion.

All you have to do is execute the attached advert, which will generate your
personal User ID, you dont even have to provide information as your
personal credit card number, etc.

And if you like our site, please tell all your friends about us.

http://www.hoteens.com/

HoTeens.com

It calls the second routine depending on a random counter. It looks for the DialUp database and sends it to the author.

The virus contains the following text in its encrypted code:

– Parvo BioCoded by GriYo / 29A – Win32 Tech Support by Jacky Qwerty / 29A
– Thanks to Darkman / 29A and b0z0 / Ikx for their ideas and strategy
– Parvo is a research speciment, do not distribute
– c1999 29A Labs … We create life –

Origin

Parvo was coded in 1999 in Spain by GriYo of 29A in Assembly. GriYo credits Darkman, also of 29A and b0z0 of Ikx for inspiring some ideas and strategy. He also gave thanks to Jacky Qwerty for some technical support with 32-bit Windows. Its CRC calculations were originally coded in C by Mark Adler and translated into Assembly by GriYo himself. There is also a version that sends identical emails in Spanish.

The name "Parvo" comes from the canine Parvovirus. The biological version infects wild and domestic dogs, causing vomiting, diarrhea, lethargy, and death. It is also extremely infectious and hardy, able to survive a wide range of temperatures and can stick to surfaces like shoes and car tires.

Other Facts

At the time, the virus was noted for being large for something in Assembly. Other viruses at the time that sent infected files over the Internet include the Windows RedTeam virus as well as the macro viruses Antimarc, Innuendo, and ShareFun.

Sources

GriYo. 29A Magazine, Issue 4, Parvo BioCoded by GriYo / 29A. 1999

Kaspersky Lab, VIRUS.WIN32.PARVO.