May 1995

The attached XCAIBUA.EXE file is a virus scanner dedicated to spot and
neutralize programs infected with the Big Caibua (aka Butthead) virus.

Caibua is dangerous because of its TWO STAGES PAYLOAD. It activates a
simple payload first, that consists of a phallic animation on screen.
The first payload is a diversion to distract the user from the second
payload which is more harmful. It will format track 0 of drive C:,
delete the first file in the directory, create junk directories and
trash data at random.

On the execution of an infected file, two more COM files will be
infected. Each consecutive infected file will be one byte longer than
the former infected one. An internal counter is advanced with each
generation of infection. When the counter reaches the value of 2296, the
second (andf destructive) payload is activated. The initial value of the
counter was set at about 2260, yet the copy of the virus we got showed
already 2277.

The animation was devised to encourage users demonstrate the virus to
friends, and unknowingly progress the counter until it will eventually
go off. Twenty generations for a virus is very little, and it's quite
likely that users will get really affected by Caibua, shortly.

To scan for the virus just run XCAIBUA.EXE on the suspected drive. To
rename the infected files to a non-executable extension (*.IVC), add the
/R switch to the command line. All DOS legal pathnames are acceptable
such as \, C:\, C:\*.COM etc. The /R switch can be put before or after
the pathname to search.

XCAIBUA is hereby donated to the public domain. The author, and NetZ
Computing assume no responsibility of any sort for the program, nor for
its performance, nor for any consequences from its use.

XCAIBUA is derived from InVircible's technology. XCAIBUA and the new
version 6.02 of InVircible are available from the sites below.

Safe computing,

-------------------------------------------------------------------------
Zvi Netiv, author InVircible
NetZ Computing Ltd, Israel                            Fax +972 3 532 5325
email: netz@actcom.co.il  netz@InVircible.com  CompuServe 'GO InVircible'
Author's:  ftp.datasrv.co.il/pub/usr/netz/  Anonymous ftp: InVircible.com
-------------------------------------------------------------------------