Satanbug
Satanbug
Type File virus
Creator Priest (AKA Little Loc)
Date Discovered 1993.08
Place of Origin United States
Source Language
Platform DOS
File Type(s) .com, .exe, .ovl, .sys
Infection Length 3,700-5,300 bytes
Reported Costs

SatanBug is a family of encrypted polymorphic file infector viruses from 1993. It can infect four types of files, .com, .exe, .ovl and .sys. It was created by Priest, creator of the prolific Natas virus a year later.

Behavior

When SatanBug is executed, it installs itself in memory. Files are infected when they are executed or opened. The creation date of the infected file is increased by 100 years.

A SatanBug infection can have up to nine levels of encryption. This made the virus difficult for the scanners of the time to disinfect, as they were only able to handle that many levels.

The virus does not intentionally damage files or the computer, but may still cause some problems. Infected files may not work properly or at all. Some network drivers may be damaged and the computer may not connect to a network properly.

Variants

SatanBug has two variants that are only loosely related. SatanBug.1568 only infects .com files. It may disinfect the infected file, depending on the date. Fruitfly does not become memory resident, so it infects all files in the current directory and those in the path string. It deletes files named VS.VS and CHKLIST.CPS. It contains the following text strings:

  PATH=
  VS.VS
  CHKLIST.CPS
  ????????.COM
  Fruit Fly virus - Little Loc
  Hacker4Life
  Hackers In ThE Mist

Effects

SatanBug was particularly prevalent in the US state of California. It also infected the Secret Service's computers in Washington DC, causing that agency to take its computers offline for three days.

Like many other viruses, it caused more panic than actual damage. A few people though that the virus was deliberately targeted at government computers, possibly placed there by an unfriendly foreign power. The magazine "LAN Times" put the virus on the front page of its November issue with the headline, "Be on the Lookout for the Diabolical 'Satan Bug' Virus". In the article it said the virus was designed to circumvent the security of Novell Netware's NETX program, which is patently false. Little Loc himself even asked "What's NETX?" after hearing of the article. Norman Data Defense Systems and McAfee Associates software were advertised in that edition.

Creator

Norman Data Defense Systems offered Priest (also going by the name Little Loc) a job when he finished highschool that summer. When asked what he would work on there, he said he would work on a cure for his latest virus Natas.

Priest received a very unpleasant visit from the Secret Service over the creation of the SatanBug virus. They wanted to know everything about him, including his social security number and who he worked for. One agent claimed he heard a story about Little Loc saying SatanBug would infect all government computers by December of that year, which Priest denied.

It was later discovered by NuKE around April of 1994 that a virus coder named Aristotle (real name John A. Buchanan, living in Newport News, Virginia at the time) had informed the Secret Service about Priest's hobby. No reason for the sellout has ever been given.

Other Facts

The Satan Bug is a novel and movie from the 1960's about a biological virus that escapes from a lab. Whether or not Little Loc had this in mind when coding the virus is uncertain.

Sources

Computer Incident Advisory Capability, Satan Bug Virus on MS-DOS computers. 1993.09.04

Kaspersky Antivirus, Securelist. Virus.DOS.SatanBug.a. 2000.03.07

McAfee Antivirus, Sat Bug.Sat Bug. 1998.11.30

Rock Steady. NuKE Info-Journal #8, Screwing People Over, The Aristotle Style.

George Smith. The Virus Creation Labs: A Journey into the Underground, A Priest Deploys his Satanic Minions. American Eagle Publications, 1994.12. ISBN 978-1441411389

Imdb, The Satan Bug.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License