Fandom

Virus Information

Tequila

247pages on
this wiki
Add New Page
Talk0 Share
Tequila
Type Multipartite virus
Creator
Date Discovered 1991.04
Place of Origin St. Hausen, Switzerland
Source Language Assembly
Platform DOS
File type(s) .exe
Infection Length 2,468 bytes
Reported costs

Tequila is an advanced multipartite virus from 1991. It is notable for its armoring techniques, particularly in the area of decryption.

BehaviorEdit

When a file infected with Tequila is executed, the virus infects the master boot record. In a manner similar to Flip, the virus reduces the size of the disk's partition by 6 sectors and placing its code in the sectors that are outside of the partition. When the disk is booted, the virus becomes memory resident. When .exe files are executed, the virus appends its 2,468 bytes to them.

It will not infect files with the letters "sc" and "v" in their names. This is probably to avoid infecting antivirus programs.

The virus displays the message:

  "Welcome to T.TEQUILA's latest production.
  Contact T.TEQUILA/P.o.Box 543/6312 St'hausen/Switzerland
  Loving thoughts to L.I.N.D.A
  
  BEER and TEQUILA forever ! "
  
  "Execute: mov ax, FE03 / int 21. Key to go on!"

It will also display a low-resolution fractal.

ArmoringEdit

Tequila has a number of different ways of protecting itself from detection and disassembly. Its code contains many junk instructions to confuse anyone who tries to disassemble it. Similar to the Vienna virus, the seconds timestamp of an infected file is marked with the impossible value of 62. It uses this timestamp to determine when to subtract 2,468 bytes from the file's reported size when the user runs the DIR command.

The virus also makes decryption difficult, as its decryption code is also its decryption key. Setting a breakpoint outside of the virus code fails as the breakpoint instruction will be altered. Setting one inside the code will cause errors in the decryption.

EffectsEdit

The virus was relatively widespread in Europe. Two people, ages 18 and 21, were questioned by Swiss police about the virus. In 1993, Tequila was common in South Africa.

SourcesEdit

Paul Ducklin. Tequila.

Morton Swimmer. University of Hamburg, Virus Test Center, Computer Virus Catalog 1.2: "Tequila" Virus. 1991.07.15

McAfee Antivirus, Tequila. 1991.04.15

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.