Ithaqua is a multipartite polymorphic virus. It infects MBRs of hard disks and COM and EXE files that are executed. After infecting MBR the virus encrypts its contents so the logical disks are not accessible after booting from system diskette. The virus uses anti-debugging tricks, it is polymorphic in files as well as in infected MBR. The virus has many bugs and often corrupts files and MBR while infecting them.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The virus has quite a complex way of infection. It behaves differently under different DOS versions. Under DOS 7+ (Windows) the virus infects EXE files only and does not touch MBR and COM files. Upon infection the virus encrypts itself and writes its body to the end of infected files. The length of infected files increases by 8542 bytes.
Under DOS 6 and earlier DOS versions the virus infects COM and EXE files as well as MBR. MBR is infected when the first infected file is executed. While infecting EXE files the virus looks for 'cavities' (areas of constant data) 8030 bytes long and writes itself there. In this case the file length is not increased. When infecting COM files the virus writes itself to the end of the file. To get control when the infected file is executed, the virus either uses a standard method - puts a jump to its body to the beginning of infected program, or inserts a jump somewhere in the middle of the file. In the second case the virus uses simple encryption instead of its polymorphic engine. The length of infected file increases by by 8030 bytes.
Under DOS 6 the virus also uses emulator to get DOS INT 21h handler address, and modifies this address so that it points to virus Int 21h handler.
On April 29th the virus sets graphics display mode, shows the below given text and imitates a snowfall.
[Ithaqua] virus by Wintermute/29A
The virus contains the following text strings:
I'm Ithaqua,... that who walks over the wind Welcome to my world, adventurer. Follow me. Love. Hate. I'll be awaiting you on the dark side, watching the nonsense.