Beer and Tequila forever! #SophosRetroWeek looks at old-school malware…

In the early 1990s, there simply weren’t that many viruses, and there weren’t that many known ways they worked.

And, on IBM PCs, with less than 640KB to work with (because, as Bill Gates probably never actually said, “640KB ought to be enough for anybody”), there weren’t that many places viruses could hide.

In an emergency, IT support staff could usefully go looking for malware by hand, if only they knew where to look – something a malware description could help with.

Describing what 1990s malware might do was usually a lot easier than it is today, because viruses almost always spread in a self-contained fashion, so they could work without a network connection.

Once you got hold of a sample of the virus, you probably had all you needed to decompile it entirely.

That wasn’t necessarily easy, but at least it was possible, which isn’t the case with a lot of malware today.

These days, a lot of malware only grabs its “damage routines” at the last moment, so they can be changed at will by the crooks who are in control.

Additionally most zombie malware includes functions for self-updating, as well as for downloading additional, as-yet-unknown malware.

So you often can’t predict exactly how an infected computer might behave.

Anyway, that wasn’t the case in the early 1990s, so a group of malware researchers tried to come up with a standardised, if stilted, way of denoting the characteristics of the most common viruses of the day.

And, by way of contributing to #SophosRetroWeek, here’s what a malware description from that era looked like, courtesy of Yours Truly.

By the way, in case you’re wondering why Tequila avoided infecting filenames that contained either “SC” or “V” (see below)…

…it’s because that was a quick-and-dirty way to spot many security programs, such as SCAN from McAfee and VACCINE from Sophos.

Security programs often included self-verification code to check if they’d been tampered with.

So a virus writer either had to figure out how to bypass the self-checking part when infecting tamper-resistant files, or to avoid them in the first place.

I never found out what the initial “T” stood for in the author’s name, but for some reason I have always thought of them as Trevor Tequila.

Here’s the overview of his magnum opus:

OUTPUT

Execute: mov ax, FE03 / int 21. Key to go on! Welcome to T.TEQUILA's latest production. Contact T.TEQUILA/P.o.Box 543/6312 St'hausen/Switzerland Loving thoughts to L.I.N.D.A BEER and TEQUILA forever !