Content
Die-Hard
- Type
- Virus
- SubType
- File Infector
- Discovery Date
- 07/01/1994
- Length
- 4,000 Bytes
- Minimum DAT
- 4002 (12/02/1998)
- Updated DAT
- 4002 (12/02/1998)
- Minimum Engine
- 5.1.00
- Description Added
- 07/15/1994
- Description Modified
- 01/10/2002 10:16 PM (PT)
Tab Navigation
Characteristics
Die_Hard 2 is a symbiotic, memory resident, file infecting virus which uses stealth techniques. Die_Hard 2 infects .COM and .EXE files, including COMMAND.COM.
Upon infection, the virus becomes resident in system memory. Die_Hard 2 infects files as they are executed or opened and attaches itself to the end of the file.
Additional Comments:
The Die Hard 2, or DH2, virus was received in July, 1994. It is from Jakarta in the Republic Of South Africa. Die Hard 2 is a memory resident full stealth virus which infects .COM and .EXE programs, including COMMAND.COM. When the first Die Hard 2 infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary hooking interrupts 10 and 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 4,000 bytes. Once memory resident, the Die Hard 2 virus will infect programs when they are executed or opened. Infected programs will have a file length increase of 4,000 bytes with the virus being located at the end of the file. The program's file length increase will not be visible within the DOS disk directory listing, nor will the viral code be visible within the infected file, when the virus is memory resident as Die Hard 2 is a full stealth virus, disinfecting programs "on the fly". The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "SW DIE HARD 2" The DOS CHKDSK program, when executed with Die Hard 2 in memory, will not indicate file allocation errors on infected files. Programs infected with Die Hard 2 can be fairly easily manually disinfected. The system user should execute a program known to be infected in order to insure that the virus is memory resident. All of the executable programs on the system should then be archived using a program such as PKWare's PKZIP program. The system must then be cold booted from a known clean boot disk. Without executing any programs from the system hard drive, the archive files created earlier should be used to replace the executable programs on the system hard drive.
Symptoms
Infected systems have a decrease of 4,000 bytes in system and available free memory, as indicted by the DOS CHKDSK program. An infected files have a file length increase of 4,000 bytes. However the file length increase is not visible, when the virus is memory resident. The file's date and time are not altered, when viewed in the DOS disk directory.
Method of Infection
The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.
Removal
All Users :
Script,Batch,Macro and non memory-resident:
Use current engine and DAT files for detection and removal.
PE,Trojan,Internet Worm and memory resident :
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:
Additional Windows ME/XP removal considerations
Users should not trust file icons, particularly when receiving files from others via P2P clients, IRC, email or other mediums where users can share files.
AVERT Recommended Updates :
* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch )
* scriptlet.typelib/Eyedog vulnerability patch
* Outlook as an email attachment security update
* Exchange 5.5 post SP3 Information Store Patch 5.5.2652.42 - this patch corrects detection issues with GroupShield
For a list of attachments blocked by the Outlook patch and a general FAQ, visit this link .
Additionally, Network Administrators can configure this update using an available tool - visit this link for more information .
It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.
Variants
Variants
N/A
All Information
Overview -
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Aliases
- CrystalDiamond.4000 (InoculateIT)
- DH2
- Diamond-4000 (Alwil)
- Die Hard #3 (AntiVir)
- Die Hard (VET)
- Die Hard 2
- Die_Hard (AVG/ESET/Norman)
- Die_Hard.4000 (AVG/FProt/Panda/RAV/VirusBuster/CA)
- DIE_HARD_2 (Trend)
- DieHard-D (Sophos)
- DieHard.2 (AntiVir)
- DieHard.2000 (RAV)
- DIEHARD.2HK (Trend)
- DieHard.4000 (AntiVir)
- DieHard2.4000 (KAV/AVP/VirusBuster)
- DIEHARD2.4000 (Trend)
- OZ
- Sayha.DieHard (DrWeb)
- SWDie.4000 (NAV)
- SwDieHard (Sophos)
- SwDieHard-4000 (Alwil)
- Vbs.Dropper.Die_Hard.A (Ikarus)
- Vgen.13885 (AntiVir)
- Vgen.19788 (AntiVir)
- Vgen.26239 (AntiVir)
- Vgen.32626 (AntiVir)
- Vgen.32627 (AntiVir)
- Wix
Characteristics
Characteristics -
Die_Hard 2 is a symbiotic, memory resident, file infecting virus which uses stealth techniques. Die_Hard 2 infects .COM and .EXE files, including COMMAND.COM.
Upon infection, the virus becomes resident in system memory. Die_Hard 2 infects files as they are executed or opened and attaches itself to the end of the file.
Additional Comments:
The Die Hard 2, or DH2, virus was received in July, 1994. It is from Jakarta in the Republic Of South Africa. Die Hard 2 is a memory resident full stealth virus which infects .COM and .EXE programs, including COMMAND.COM. When the first Die Hard 2 infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary hooking interrupts 10 and 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 4,000 bytes. Once memory resident, the Die Hard 2 virus will infect programs when they are executed or opened. Infected programs will have a file length increase of 4,000 bytes with the virus being located at the end of the file. The program's file length increase will not be visible within the DOS disk directory listing, nor will the viral code be visible within the infected file, when the virus is memory resident as Die Hard 2 is a full stealth virus, disinfecting programs "on the fly". The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "SW DIE HARD 2" The DOS CHKDSK program, when executed with Die Hard 2 in memory, will not indicate file allocation errors on infected files. Programs infected with Die Hard 2 can be fairly easily manually disinfected. The system user should execute a program known to be infected in order to insure that the virus is memory resident. All of the executable programs on the system should then be archived using a program such as PKWare's PKZIP program. The system must then be cold booted from a known clean boot disk. Without executing any programs from the system hard drive, the archive files created earlier should be used to replace the executable programs on the system hard drive.
Symptoms
Symptoms -
Infected systems have a decrease of 4,000 bytes in system and available free memory, as indicted by the DOS CHKDSK program. An infected files have a file length increase of 4,000 bytes. However the file length increase is not visible, when the virus is memory resident. The file's date and time are not altered, when viewed in the DOS disk directory.
Method of Infection
Method of Infection -
The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.
Removal -
Removal -
All Users :
Script,Batch,Macro and non memory-resident:
Use current engine and DAT files for detection and removal.
PE,Trojan,Internet Worm and memory resident :
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:
Additional Windows ME/XP removal considerations
Users should not trust file icons, particularly when receiving files from others via P2P clients, IRC, email or other mediums where users can share files.
AVERT Recommended Updates :
* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch )
* scriptlet.typelib/Eyedog vulnerability patch
* Outlook as an email attachment security update
* Exchange 5.5 post SP3 Information Store Patch 5.5.2652.42 - this patch corrects detection issues with GroupShield
For a list of attachments blocked by the Outlook patch and a general FAQ, visit this link .
Additionally, Network Administrators can configure this update using an available tool - visit this link for more information .
It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.
Variants
Variants -
N/A
