Fandom

Virus Information

Commander

249pages on
this wiki
Add New Page
Talk0 Share
Commander
Type File virus
Creator Dark Avenger
Date Discovered 1992.05
Place of Origin Sophia, Bulgaria
Source Language Assembly
Platform DOS
File type .com
Infection Length 4,096 bytes
Reported costs

Commander, also called Commander Bomber is a virus by Dark Avenger. Its method of infecting files was particularly interesting and it made the work of antivirus researchers very difficult.

BehaviorEdit

When an infected file is executed, Commander becomes memory resident in low system memory. It infects .com files as they are executed.

Commander inserts its main body somewhere in the middle of the file. A block of code is placed at the beginning of the file, which points to another block of randomly-placed code in the file, which itself points to another randomly-placed block of code. There may be several of these before the code finally points to the virus body.

These blocks of code are polymorphic and use the Dark Avenger Mutation Engine. In addition, the blocks contain a great deal of garbage code, making them all the more difficult to read. Furthermore, the ways to transfer control to the next block of code and to the virus body are obfuscated. The virus body itself is not encrypted.

The beginning of the virus body contains the unencrypted text:

  COMMANDER BOMBER WAS HERE

and:

  [DAME]  [DAME]


EffectsEdit

Commander made the work of virus researchers very difficult. The infection method required scanners to search entire files to find the virus and its blocks. Very few scanners in the early 1990's could do this effectively and fewer could do it quickly.

NameEdit

Commander takes its name from the COMMANDER BOMBER text at the beginning of the virus body. Antivirus vendors have usually called it something along the line of Commander Bomber (sometimes the first word shortened to Cmdr) or Bomber. Bomber is also a Malaysian virus from about the same time.

Other FactsEdit

In The Art of Computer Virus Research and Defense Peter Szor says Commander was coded in late 1993 and was one of Dark Avenger's last viruses. All other sources say it is from early 1992, and one post to Virus-L proves that it was known in 1992.

SourcesEdit

Peter Szor. The Art of Computer Virus Research and Defense, pp 142, 143. Addison Wesley, Pearson Education, Symantec Press: 2005. ISBN 0-321-30454-3

Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Bomber.

VIRUS-L Digest, Volume 5 : Issue 169, "Re: KEY Press virus & McAfee v97 (PC)". 1992.10.28

Patricia Hoffman. Online VSUM, [Cmdr Bomber Virus].

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.