Carbuncle is a dangerous memory residentcompanion virus. It is a COM file 622 bytes long. On execution it checks the system time, and depending on the current seconds value it either jumps to an infection routine or calls the triggerfunction.
In the infection routine the virus creates the file CARBUNCL.COM with the READONLY and HIDDEN attributes set and writes itself (622 bytes) into that file. If this file is present, the virus overwrites it if this file is not a READONLY one. If this file is READONLY, the virus tries to create and overwrite it but fails because it doesn't check/clear the file attributes. Then the virus searches for EXE files by using DOS functions FindFirst/FindNext and the mask '*.exe' and infect them. On infection the virus renames the EXE file to CRP and creates a batch companion file with the name of the infected program and a . BATextension.
As the result, after infection of one EXE file there are two files with the same name and CRP and BAT extensions. Of course, CARBUNCL.COM is in the same directory also. The companion batch file contains six lines of DOS commands. If the file FILENAME.EXE was infected, the companion FILENAME.BAT contains these lines: @ECHO OFF CARBUNCL RENAME FILENAME.CRP FILENAME.EXE FILENAME. EXE RENAME FILENAME.EXE FILENAME.CRP CARBUNCL
If the user tries to execute the EXE program, DOS will execute the companionBAT file virus. On the first line of this BAT file the virus disables DOSecho for more invisibility. The instruction of the second line calls the main virus body from CARBUNCL.COM file, the virus searches for non-infected files and attacks them. The lines from the third to the fifth force DOS to execute the infected EXE that is hidden by a CRPextension. This file is renamed to an EXE extension, then it is executed as an EXE and then it is renamed back to CRP. And as the last action the BAT file executes the COM virus again. If the current seconds value of system times is lesser or equals than 16, the virus calls trigger subroutine. This code searches for the first five CRP files and overwrites them by the virus body. As the result these files are not recoverable and should be deleted. In another case they will spread the virus on execution. The virus contains the internal text strings which are in use on searching for not infected files and on creating BATcompanion: *.crp CARBUNCL. COM BAT*.exe CRP @ECHO OFF CARBUNCL RENAME It also contains the 'copyright' string: PC CARBUNCLE: Crypt Newsletter 14 Research Carbuncle
CRP is an abbreviation for Celestial Relays and Power
CRP is an abbreviation for Control Reporting Post
CRP is an abbreviation for Modular Control Equipment Research CRP
The INS Eilat is an Israeli Sa'ar 5 Class corvette launched in 1993. The Eilat accommodates 61 crew comprised of 25 officers and 36 enlisted men and 10 aircrew. Airborne anti-submarine warfare capability is provided by the ship's helicopter. The ship's helicopter hangar can accommodate an H-665A Dauphin, Kaman SH-2F or Sikorsky S-76N helicopter. The ship is fitted with six 324 mm Mark 32 torpedo tubes for Honeywell Mark-46 torpedoes mounted in the superstructure about halfway along the length of the ship. The ship's anti-air capability is based on the Barak vertically launched missile system. The two 32 cell vertical launch systems are installed on the raised gun deck at the bow of the ship immediately behind the main gun. The ship has two quadruple Harpoon missile launchers for defence against anti-surface missiles. The ship's short to medium range anti-ship missile is the Gabriel II and there are eight Gabriel launchers contained in lightweight fibreglass housings, arranged four on each side of the ship.
The ship's propulsion system is in a CODOG combined diesel or gas configuration. The two MTU 12V 1163 TB82 diesel engines are rated at 6,600 horsepower. The General Electric LM 2500 gas turbine system is cross connected and provides 30,000 horsepower. The propulsion system drives two shafts with controllable pitch propellers. Normal modes of operation are boost mode with the gas turbine driving two shafts, and cruise mode with each diesel driving its own shaft. The propulsion system has normal, reverse, special and silent modes of operation. The propulsion system provides a maximum speed of 33 knots. The cruise speed on the diesel engines is over 20 knots and the endurance is 4,000 nautical miles. The large twin rudder provides manoeuvrability at high speed and the controllable reversible pitch (CRP) propellers give manoeuvrability at low speed. Research Eilat
The Probert Encyclopaedia was designed, edited and programed by
Matt and Leela Probert
Abbreviations
Research Carbuncle
