Tristesse
Tristesse
Type File virus
Creator Second Part to Hell
Date Discovered 08-SEP-2004
Place of Origin Austria
Source Language FASM Assembly
Platform DOS, MenuetOS
File Type(s) .com
Infection Length 1,572 Bytes

Tristesse is a cross-platform MenuetOS and DOS virus. It was created by Second Part to Hell of the Ready Rangers Liberation Front. It is the second MenuetOS infecting virus and the first cross-platform MenuetOS-DOS virus.

Behavior

When a file infected with Tristesse is executed, the virus looks for files in the current directory to infect. The virus will first read the file to ensure it was not previously infected. It prepends itself to MenuetOS executables and appends to DOS .com executables. When it infects across platforms, it is equally capable of infecting from Menuet to DOS and DOS to Menuet.

It has a routine to avoid heuristic detection.

Name and Origin

It is a creation of Second Part to Hell, a coder based in Austria and member of Ready Rangers Liberation Front. Writing Tristesse and its predecessor Oxymoron was Second Part to Hell's introduction to Assembly language. Originally he merely joked about writing viruses for the MenuetOS platform, but later took it as a challenge. It is among his favorites. It is uncertain if he was in Vienna at the time he wrote the virus, making it difficult to determine the exact point of origin.

Second Part to Hell described the process of writing the virus as one of the most difficult, and not only because it was one of his first assembly language viruses. Coding the DOS to Menuet file infection was the most difficult aspect. He had at some point considered Windows 32-bit portable executables, but found it impossible as the memory requirements were too high to infect those from MenuetOS.

Tristesse originates from a French word that can translate into sadness, sorrow, grief, gloom, misery, distress, or meloncholy. Composer Frédéric Chopin wrote an étude in 1832 named Tristesse.

Sources

Crescencio Reyes. Trend Micro, MENUETVIR. 25-DEC-2004

Alcopaul. Brigada Ocho, Interview with Second Part To Hell. JUN-2011

Second Part to Hell. Menuet/COM.Tristesse (source code). SEP-2004

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License