Virus Targets Popular Calculators

A popular brand of calculators is being infected by a new virus that causes screens to read, "t89.GARRA."

The virus, which attacks Texas Instruments TI89 and compatible calculators, doesnt do any permanent harm, but Texas Instruments engineers havent found a way to disable it either. And while the author of the virus has been charitable enough to include code for disabling it, researchers have not been able to validate that fix.

Resource Library:

TIOS.Tiagra, as it has been dubbed by researchers at Symantec, cannot spread without use of a USB cable.

The virus works by appending its code to any suitable file, and searches for a particular instruction sequence to replace and point towards the virus code. If the sequence is not found, the virus will remain but will not gain control, according to Symantec security researchers.

The virus only runs on files with ASM extensions, so, in order to propagate itself, it has to run a check on the calculator for ASM-type files; moreover, it cannot infect previously infected files, Symantec officials said in an advisory.

ASM is a filename extension for assembly language source programs. When successfully launched, the virus clears the calculators screen and presents a message that reads: t89.GARRA. According to the advisory, the calculator will resume normal operations once infection is complete.

"To our knowledge, there is no damage caused," said Javier Santoyo, manager of development at Symantec. "There is a payload that executes only very rarely; if an infected file is executed at a specific moment in time, then a message will be displayed, after which the calculator remains fully functional."

Symantec has rated the threat posed by the virus as "low." The virus can only spread if it is shared between users via a USB cable, Santoyo said.

"Because we have no on-calculator scanner, we are not entirely sure how to detect and remove the virus," he said. "Detection could be done by extracting files to the desktop and scanning them, but thats not really viable. The virus author wrote a repair routine that can run on the calculator, but we havent checked that it works."

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.