Beruflich Dokumente
Kultur Dokumente
Example: Icelandic
h - in high memory but below TOM
(Resides in high system memory, right below TOM.
Memory is allocated so it won't be accidently
overwritten.)
Example: Flash
s - in low (system/TSR) memory
(reduces free memory, typically uses a normal
Int 21/Int 28 TSR)
Example: Jerusalem
t - above TOM but below 640k (moves Int 12 return)
(Reduces total memory size and free memory)
Example: Pakistani Brain
(above 640k)
b - in BIOS/Video/Shadow RAM area (segment A000 - FFFF)
e - in extended/expanded memory (above 1 Meg)
S = Spawning or companion file virus
(This type of virus creates another file on the disk which
contains the actual viral code. Example: Aids II)
T = Manipulation of the File Allocation Table (FAT)
X = Manipulation/Infection of the Partition Table
Detection Method:
This entry indicates how to determine if a program or
system has been infected by the virus. Where the virus
can be detected with a shareware, public domain, or
readily available commercial program, it is indicated.
Note that a "+" after the anti-viral product's version number
indicates that versions of the product from the indicated version
forward are applicable.
Programs referenced in the listing are:
AVTK
- Dr. Solomon's Anti-Virus Toolkit <commercial>
F-PROT
- Fridrik Skulason's F-Prot detector/disinfector
IBM Scan - IBM's Virus Scanning Program <commercial>
NAV
- Norton AntiVirus <commercial>
Pro-Scan - McAfee Associates' Pro-Scan Program <commercial>
VirexPC - MicroCom's VirexPC Program <commercial>
VirHunt - Digital Dispatch Inc's VirHunt Program <commercial>
ViruScan - McAfee Associates' ViruScan Program
ViruScan/X- McAfee Associates' ViruScan Program with /X switch
Removal Instructions:
Brief instructions on how to remove the virus. Where
a shareware, public domain, or readily available
commercial program is available which will remove the
virus, it is indicated. Programs referenced in the
listing are:
AntiCrim - Jan Terpstra's AntiCrime program
CleanUp - John McAfee's CleanUp universal virus
disinfector.
Note: CleanUp is only indicated for a virus
if it will disinfect the file, rather than
delete the infected file.
DOS COPY - Use the DOS COPY command to copy files from
infected non-bootable disks to newly formatted,
uninfected disks. Note: do NOT use the
DOS DISKCOPY command on boot sector infected
disks, or the new disk will also be infected!
DOS SYS - Use the DOS SYS command to overwrite the boot
sector on infected hard disks or diskettes.
Be sure you power down the system first, and
boot from a write protected master diskette,
405
Hammelburg
Extinct
1987
.COM files fail to run, first 405 bytes of .COM files
overwritten
Origin:
Austria or Germany
Eff Length: N/A
Type Code: ONC - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan 1.4+,
VirexPC 1.1+, VirHunt 2.0+, NAV
Removal Instructions: Scan/D/X, F-Prot, NAV, or delete infected files
General Comments:
The 405 virus is an overwriting virus which infects only .COM
files in the current directory. If the length of the .COM file
was originally less than 405 bytes, the resulting infected file
will have a length of 405 bytes. This virus currently cannot
recognize .COM files that are already infected, so it will
attempt to infect them again.
The 405 Virus doesn't carry an activation date, and doesn't do
anything but replicate in the current directory. However, since
it overwrites the first 405 bytes of .COM files, infected files
are not recoverable except by replacing them from uninfected
backups or master distribution disks.
Virus Name: 512
Aliases:
512-A, Number of the Beast Virus, Stealth Virus
V Status:
Rare
Discovery: November, 1989
Origin:
Bulgaria
Symptoms:
Program crashes, system hangs, TSR.
Eff Length: 512 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V58+, VirexPC 1.1+
Removal Instructions: CleanUp V58+
General Comments:
The 512 virus is not the same as the Original Friday The 13th COM
Infected files can be easily identified as they will always end with
the hex string: "EAF0FFFFFF".
This virus appears to do nothing except replicate.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
834 Virus
Arab
Rare
February, 1991
.COM file growth; TSR; Partition Table altered;
Unexpected disk accesses to hard disk;
Attempts to boot system from hard disk may hang
Origin:
Unknown
Eff Length: 834 Bytes
Type Code: PRsC - Parasitic Resident COM Infector
Detection Method: ViruScan V76+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The 834 Virus was received in February, 1991. Its origin is unknown.
This virus is a memory resident infector of .COM files, but not
COMMAND.COM.
The first time a program infected with the 834 Virus is executed, the
virus will install itself memory resident as a low system memory TSR
of 1,808 bytes. Interrupt 21 will be hooked by the virus as well. At
this time, the virus will access the hard disk partition table, altering
it.
After the 834 Virus is memory resident, it will infect .COM files of
a length greater than 4K in length as they are executed. COMMAND.COM,
however, will not be infected. Infected files will increase in length
by 834 bytes, the virus will be located at the end of the infected
program. The file date and time in the disk directory is not altered
by the virus.
Systems infected with the 834 Virus may notice unexpected accesses to
the system hard disk when executing programs from a diskette. These
accesses are the virus accessing the hard disk partition table each
time an infected program is executed, or a program is infected by the
virus. The system's hard disk partition table does not contain an
infectious copy of the virus, but has been altered so that later
attempts to boot the system from the system hard disk may result in a
system hang occurring during the boot process.
Known variant(s) of 834 include:
834-B/Arab: Similar to the original virus, this variant will infect
.COM files other than COMMAND.COM which are greater than 1K in
length before infection. Two text strings occur within this
variant's code: "nsed Materi" and "COMMAND.COM". Low system
memory TSR is 1,792 bytes in length.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Origin:
903
Rare
January, 1991
.COM file growth; TSR; System hangs
France
1008
Suomi, Oulu
Rare
June, 1990
COMMAND.COM growth, Internal Stack Errors,
System Halt on Boot
Origin:
Helsinki, Finland
Eff Length: 1,008 Bytes
Type Code: PRCK - Parasitic Resident COM Infector
Detection Method: ViruScan V64+, F-Prot 1.12+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, F-Prot 1.12+, Pro-Scan 2.01+, NAV,
or delete infected files
General Comments:
The 1008 Virus was discovered in June, 1990 by Petteri Jarvinen of
Helsinki, Finland. It is a memory resident .COM infector, and will
infect COMMAND.COM. This virus is also sometimes referred to as
the Suomi Virus.
The first time a program infected with the 1008 virus is executed,
the virus will install itself memory resident. COMMAND.COM is also
infected at this time, resulting in its length increasing by 1,008
1226
V1226
Rare
July 1990
.COM growth, decrease in system and free memory, system hangs,
spurious characters displayed in place of program executing,
disk drive spinning
Origin:
Bulgaria
Eff Length: 1,226 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+
Removal Instructions: Scan/D, or delete infected files
General Comments:
The 1226 Virus was isolated in Bulgaria in July 1990 by Vesselin
Bontchev. This virus is a memory resident generic .COM infector,
though it does not infect COMMAND.COM. The 1226 Virus is a selfencrypting virus, and simple search string algorithms will not work
to detect its presence on a system.
The first time a program infected with the 1226 virus is executed,
the virus will install itself memory resident, reserving 8,192 bytes
of memory at the top of free memory. Interrupt 2A will be hooked.
Once 1226 is memory resident, the virus will attempt to infect any
In addition to infecting .COM files when they are executed, the 1226D
Virus will infect .COM files with a length of at least 1,226 bytes
when they are openned for any reason. The simple act of copying a
.COM file with the virus memory resident will result in both the
source and target files being infected.
Unlike the 1226 Virus, systems infected with the 1226D virus will not
experience the system hangs or spurious characters symptomatic of the
1226 virus. Infected system will still indicate that they have 8,192
bytes less of total system memory than is installed on the machine.
Known variant(s) of 1226D are:
1226M/V1226M : Similar to the 1226D virus, except that files are not
infected on file open, only when they are executed.
Also see: 1226
Virus Name: 1253
Aliases:
AntiCad, V-1
V Status:
Rare
Discovery: August, 1990
Symptoms:
TSR; BSC; COMMAND.COM & .COM file growth; partition table change
Origin:
Austria
Eff Length: 1,253 Bytes
Type Code: PRsBCKX - Parasitic Resident .COM & Partition Table Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+, NAV
Removal Instructions: Pro-Scan 2.01+, NAV, Scan/D plus MDisk/P
General Comments:
The 1253 Virus was submitted in August 1990. It is believed to have
originated in (or at least to have been first isolated in) Austria.
1253 is a generic infector of .COM files, including COMMAND.COM.
It also infects the boot sector of diskettes and the partition table
of hard disks.
The first time a program infected with the 1253 Virus is executed, the
virus will install itself memory resident as a low system memory TSR.
The TSR will be 2,128 bytes in length, hooking interrupts 08, 13, 21,
and 60. Total system memory will remain unchanged, and free memory
will decrease by 2,128 bytes. At this time, the partition table of
the system's hard disk is infected with the 1253 virus. If the
infected program was executed from a diskette, the diskette's boot
sector will also be infected.
Each time a .COM file is executed with the virus resident in memory,
the .COM file will be infected if it hasn't previously been infected.
The 1253 Virus appends its viral code to the end of the .COM file, and
then changes the first few bytes of the program to be a jump to the
appended code. Infected files increase in length by 1,253 bytes, and
the virus makes no attempt to hide the increase when the directory
is displayed. Infected files will also have their fourth thru sixth
bytes set to "V-1" (hex 562D31).
Any diskettes which are accessed while the virus is present in memory
will have their boot sector infected with this virus. Newly formatted
diskettes, likewise, will be infected immediately.
The 1253 virus is destructive when it activates. The author of this
listing was able to get it to activate by setting the system date to
December 24 and then executing an infected program on drive A:. The
it is highly modified.
This virus was developed as a research virus by Mark Washburn, who
wished to show the anti-viral community why identification string
scanners do not work in all cases. The encryption used in 1260 is
one of many possible cases of the encryption which may occur with
Washburn's later research virus, V2P2.
Also see: V2P2, V2P6, V2P6Z
Virus Name: 1381 Virus
Aliases:
Internal
V Status:
Rare
Discovery: June, 1990
Symptoms:
.EXE growth
Origin:
Eff Length: 1,381 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan V64+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The 1381 Virus was isolated in June, 1990. It is a non-resident
generic .EXE infector.
Each time a program infected with the 1381 Virus is executed, the
virus will attempt to infect one other .EXE file on the current
drive. An .EXE file will only be infected if it is greater than
1,300 bytes in length before infection. After infection, files
will have increased in length by between 1,381 and 1,389 bytes.
The virus can be found at the end of infected files. Infected
files will also contain the following text strings:
"INTERNAL ERROR 02CH.
PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !
DO NOT FORGET TO REPORT THE ERROR CODE !"
It is currently unknown what the 1381 Virus does, or what prompts
it to display the above message.
Known variant(s) of 1381 include:
1381-B/Internal: Similar to the original 1381 virus, this variant is
very similar. The major change is that it does not always
infect a .EXE file each time an infected program is executed.
The increase in file length on infected files will 1,381 to
1,395 bytes, and the virus will be located at the end of the
infected file. The message text indicated above for the
original virus will be displayed if the year is 1991 or greater.
When the message is displayed, the program that was being
executed will be disinfected by the virus.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Origin:
Eff Length:
1392
Amoeba Virus
Rare
March, 1990
TSR, .COM & .EXE growth, dates modified
Indonesia
1,392 Bytes
1575
1577, 1591
Common
January, 1991
.COM & .EXE growth; decrease in total system & available memory;
Sluggishness of DIR commands; file date/time changes
Origin:
Taiwan
Isolated:
Ontario, Canada
Eff Length: 1,575 Bytes
Type Code: PRfAk - Parasitic Resident .COM & .EXE Infector
15-20%.
After becoming memory resident, any .COM or .EXE file executed will
be infected by the virus. .COM files will increase in size by
1,605 bytes in all cases with the virus's code being located at the
beginning of the file. .EXE files will increase in size by between
1,601 and 1,610 bytes with the virus's code being located at the
end of the infected file.
Other than replicating, it is unknown if this virus carries any
damage potential.
Known variant(s) of the 1605 Virus are:
1605-B : This variant was received by MicroCom in London, England in
March 1991 in a plain envelope with a London postmark. The
label on the diskette read "Solomon Virus", though the virus
is not related in any way to Dr. Solomon. This variant is
very similar to the 1605 virus described above, the major
difference is that infected .EXE files will increase in size
by 1,605 to 1,619 bytes.
Virus Name: 1704 Format
Aliases:
V Status:
Rare
Discovery: January, 1989
Symptoms:
TSR, Falling letters, .COM growth, formatted disk
Origin:
Eff Length: 1,704 Bytes
Type Code: PRC - Parasitic Encrypting Resident .COM Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVKT 3.5+, VirHunt 2.0+, NAV
Removal Instructions: CleanUp, Scan/D, F-Prot, Pro-Scan, VirexPC, VirHunt 2.0+
General Comments:
Like the Cascade Virus, but the disk is formatted when the
virus activates. Activation occurs during the months of
October, November, and December of any year except 1993.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms :
1720
PSQR Virus
Rare
March, 1990
TSR, .COM & .EXE growth, partition table damage on activation,
programs on diskette deleted on Friday The 13ths
Origin:
Spain
Eff Length: 1,720 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V61+, VirexPC 1.1+, F-Prot 1.12+, VirHunt 2.0+,
Pro-Scan 2.01+, NAV
Removal Instructions: NAV, Scan /D, VirHunt 2.0+, or delete infected files
General Comments:
The 1720, or PSQR Virus, is a variant of the Jerusalem Virus which
was first isolated in Barcelona, Spain, in March 1990. This virus,
infects .COM and .EXE files, though unlike Jerusalem, it does not
infect Overlay files. COMMAND.COM will also not be infected.
The first time an infected file is executed, the virus will install
itself memory resident, and then infect each executable file as it
is run.
On Friday The 13ths, the 1720 Virus will activate the first time an
infected program is executed. When the program is executed, it will
be deleted from disk. More damaging, however, is that the 1720 virus
will check to see if the system has a hard disk drive. If a hard
disk drive is present, the virus will overwrite the boot sector and
partition table resulting in all data on the hard disk becoming
unavailable. The system will also appear to hang.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
4096
Century Virus, FroDo, IDF Virus, Stealth Virus, 100 Years Virus
Common
January, 1990
.COM, .EXE, & overlay file growth; TSR hides growth; crosslinks;
corruption of data files
Origin:
Israel
Eff Length: 4,096 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V53+, F-Prot, IBM Scan, Pro-Scan, VirexPC 1.1+,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: CleanUp V62+, Pro-Scan 1.4+, F-Prot, VirHunt 2.0+,
NAV, or see note below
General Comments:
The 4096 virus was first isolated in January, 1990. This virus
is considered a Stealth virus in that it is almost invisible
to the system user.
The 4096 virus infects .COM, .EXE, and Overlay files, adding
4,096 bytes to their length. Once the virus is resident in
system memory, the increase in length will not appear in a
directory listing. Once this virus has installed itself into
memory, it will infect any executable file that is opened,
including if it is opened with the COPY or XCOPY command.
This virus is destructive to both data files and executable
files, as it very slowly crosslinks files on the system's
disk. The crosslinking occurs so slowly that it appears there
is a hardware problem, the virus being almost invisible. The
crosslinking of files is the result of the virus manipulating
the FATs, changing the number of available sectors, as well as
the user issuing CHKDSK/F commands which will think that the
files have lost sectors or crosslinking if the virus is in
memory.
As a side note, if the virus is present in memory and you
attempt to copy infected files, the new copy of the file will
not be infected with the virus if the new copy does not have
an executable file extension. Thus, one way to disinfect
a system is to copy off all the infected files to diskettes with a
non-executable file extension (ie. don't use .EXE, .COM, .SYS, etc)
while the virus is active in memory, then power off the system
and reboot from a write protected (uninfected) system disk.
Once rebooted and the virus is not in memory, delete the
infected files and copy back the files from the diskettes to the
original executable file names and extensions.
The above will disinfect the system, if done correctly, but
will still leave the problem of cross-linked files which are
permanently damaged.
Akuku
Rare
January, 1991
.COM & .EXE growth; "Error in EXE file" message;
Unexpected drive accesses
Origin:
USSR
Eff Length: 891 Bytes
Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Akuku Virus was isolated in January, 1991, and comes from the
USSR. This virus is a non-resident direct action infector of .COM and
.EXE files, including COMMAND.COM.
When a program infected with Akuku is executed, the virus will infect
three programs in the current directory. If three uninfected programs
cannot be found in the current directory, the virus will search the
disk directory of the current drive, as well as of the C: drive.
Both .COM and .EXE programs may become infected, as well as COMMAND.COM.
Programs smaller than 1K will not be infected by this virus. Infected
programs will increase in length by 891 to 907 bytes, the virus will be
located at the end of the infected file. The file date and time in the
disk directory will not be altered by the virus.
The following text string is contained within the virus's code, and
can be found in all infected programs:
"A kuku, Nastepny komornik !!!"
Some .EXE programs will fail to execute properly after infection by the
Akuku Virus. These programs may display an "Error in EXE file"
message and terminate when the user attempts to execute them.
Virus Name: Alabama
Aliases:
V Status:
Endangered
Discovery: October, 1989
Symptoms:
.EXE growth, Resident (see text), message, FAT corruption
Origin:
Israel
Eff Length: 1,560 bytes
Type Code: PRfET - Parasitic Resident .EXE infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: CleanUp, F-Prot, Pro-Scan 1.4+, Scan/D/X, VirHunt 2.0+,
or delete infected files
General Comments:
The Alabama virus was first isolated at Hebrew University in
Israel by Ysrael Radai in October, 1989. Its first known
activation was on October 13, 1989. The Alabama virus will
infect .EXE files, increasing their size by 1,560 bytes. It
installs itself memory resident when the first program infected
with the virus is executed, however it doesn't use the normal
TSR function. Instead, this virus hooks Int 9 as well as making
use of IN and OUT commands. When a CTL-ALT-DEL combination is
detected, the virus causes an apparent boot but remains in RAM.
The virus loads itself 30K under the highest memory location
reported by DOS, and does not lower the amount of memory
reported by BIOS or DOS.
After the virus has been memory resident for one hour, the
following message will appear in a flashing box:
"SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW..............
Box 1055 Tuscambia ALABAMA USA."
The Alabama virus uses a complex mechanism to determine whether
or not to infect the current file. First, it checks to see if
there is an uninfected file in the current directory, if there
is one it infects it. Only if there are no uninfected files
in the current directory is the program being executed
infected. However, sometimes instead of infecting the
uninfected candidate file, it will instead manipulate the FATs
to exchange the uninfected candidate file with the currently
executed file without renaming it, so the user ends up thinking
he is executing one file when in effect he is actually
executing another one. The end result is that files are
slowly lost on infected systems. This file swapping occurs
when the virus activates on ANY Friday.
V-847
V-847B
V-852
Anti-Pascal II
Anti-Pascal 400, AP-400
Research
June, 1990
.COM growth; .BAK, .BAT and .PAS file deletion, boot sector
alteration on hard disk
Origin:
Bulgaria
Isolated:
Sofia, Bulgaria
Eff Length: 400 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan/X V67+, Pro-Scan 2.01+, NAV
Removal Instructions: Pro-Scan 2.01+, Scan/D/X, or delete infected files
General Comments:
Attention!
USSR 394
Rare
December, 1990
.COM file growth; decrease in system and available memory;
clicking emitted from system speaker on keypress; file date/time
changes
Origin:
USSR
Eff Length: 394 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Attention! Virus was submitted in December, 1990 and was originally
isolated in the USSR. This virus is a memory resident infector of COM
files, including COMMAND.COM.
The first time a program infected with the Attention! Virus is executed,
the virus will reserve 416 bytes at the top of system memory but below
the 640K DOS boundary. The virus becomes memory resident in this area,
and hooks interrupt 21. Total system memory and available free memory
returned by the DOS ChkDsk command will decrease by 416 bytes. The
interrupt 12 return is not moved.
After the virus is memory resident, a clicking sound will be emitted
by the system speaker each time a key is pressed on the keyboard. Some
programs, such as the Edlin program supplied with MS-DOS, will receive
an "Invalid drive or file name" message when they are attempted to be
executed.
Attention! will infect COM files, including COMMAND.COM, when they are
executed. The exception is that very small COM files will not become
infected. Infected files will increase in length by 394 bytes with the
virus being located at the end of the file. Infected programs will also
contain the text string: "ATTENTION !" near the beginning of the
program.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Australian 403
Rare
February, 1991
.COM files become 403 bytes in length; TSR;
File date/time changes; .COM files do not function properly
Origin:
Australia
Eff Length: 403 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Australian 403 Virus was submitted in February, 1991 by Colin Keeble
of Australia. This virus is a memory resident infector of .COM files,
including COMMAND.COM.
The first time a program infected with the Australian 403 Virus is
executed, the virus will install itself memory resident as a low system
memory TSR of 720 bytes. The virus will hook interrupt 21.
Once the virus is memory resident, the virus will replace two .COM
programs in the current directory with a copy of the virus each time
any program is executed. The replaced programs will have a file length
of 403 bytes, and their date and time in the disk directory will have
been altered to the system date and time when infection occurred.
Needless to say, the replaced programs will not execute properly since
they now only contain the virus's code.
This virus does not do anything besides replicate.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Azusa
Rare
February, 1991
BSR; Decrease in total system and available free memory;
LPT1 & COM1 ports may be disabled
Origin:
USA
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Partition Table Infector
Detection Method: ViruScan V75+
Removal Instructions: Clean-Up V75+
General Comments:
The Azusa Virus was received in February, 1991. Its origin is unknown.
This virus is a memory resident infector of diskette boot sectors and
the hard disk partition table.
The first time the system is booted from a diskette infected with the
Azusa Virus, the virus will become memory resident at the top of
system memory, but below the 640K DOS boundary. The virus moves the
Interrupt 12 return so that the system will report 1,024 Bytes less
memory than is installed on the system. At this time, the virus will
infect the system's hard disk partition table, overwriting the
partition table with a copy of the Azusa virus. A copy of the original
partition table is not stored by the virus.
Once Azusa is memory resident, it will infect diskettes when they are
accessed on the system with write intent (ie: a file is openned as
output, or with read/write intent) or when attempting to reboot the
system from a diskette via CTL-ALT-DEL. Diskettes are infected by
copying the original diskette boot sector to track 40 sector 8, and
then writing a copy of itself to the diskette's boot sector. On
diskettes other than 360K 5.25" diskettes, the original boot sector
will end up in the middle of the disk, possibly corrupting files.
The Azusa Virus keeps track of how many times the system has been
booted from an infected diskette. After 32 boots, the virus will
disable the COM1 and LPT1 ports on the system, and reset its counter.
A later boot will result in the ports functioning properly again.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Best Wishes
Best Wish
Rare
December, 1990
.COM file growth; decrease in system and available free memory;
system hangs; file date/time changes; file not found errors;
boot sector modification
Origin:
USSR
Eff Length: 970 Bytes
Type Code: PRtCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Best Wishes Virus was submitted in December, 1990 and is believed
to be from the USSR. Best Wishes is a memory resident infector of
COM files, including COMMAND.COM. There is a variant of this virus,
Best Wishes B, which is 1,024 bytes in length.
The first time a program infected with the Best Wishes Virus is
executed, the virus will install itself memory resident in system high
memory, but below the 640K DOS boundary. The interrupt 12 return will
be moved. Total system memory will decrease by 61,440 bytes, available
free memory will decrease by 61,360 bytes. COMMAND.COM will become
infected at this time, and the disk's boot sector will also be modified.
Disks with the boot sector modification and infected COMMAND.COM will
still boot properly.
After Best Wishes is resident, the virus will infect COM files as they
are executed with a probability of 50%. Infected COM files will
increase in length by 970 bytes with the virus being located at the
end of the infected file. Infected programs will also have the following
text string located near the end of the file:
"This programm ... With Best Wishes!"
Best Wishes does not restore the original file date and time in the
Aliases:
V Status:
Discovery:
Symptoms:
Blood2
Rare
August, 1990
.COM file length increase, system reboots and/or hangs,
cascading screen effect
Origin:
Natal, Republic of South Africa
Eff Length: 418 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: Pro-Scan 2.0+, ViruScan V75+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Blood Virus was submitted by Fridrik Skulason in August, 1990.
It was originally isolated in Natal, Republic of South Africa. There
are two variants of this virus, Blood and Blood2. This virus is a
non-resident infector of .COM files, including COMMAND.COM.
When a program infected with the Blood virus is executed, it will
infect one .COM file located in the C: drive root directory. The
newly infected file will have increased in length by 418 bytes. If
the program just infected is COMMAND.COM, a system reboot will
occur. Following the system reboot, executing an infected program
will result in a cascading effect of the cursor down the screen. The
next .COM file executed will then result in the hard disk being
accessed followed by the system hanging. Spurious characters from
memory may also appear on the screen on the line below the command
line.
After August 15, execution of an infected program will result in a
system hang.
Known variant(s) of Blood are:
Blood2 : Similar to Blood, with the major difference being that
system reboots, system hangs, and the cascading cursor
effect no longer occur. This variant also does not hang
the system after August 15.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Bloody!
Rare
December, 1990
Extended boot time; decrease in system & available memory;
message on boot; boot sector & partition table changes
Origin:
Taiwan
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Partition Table Infector
Detection Method: ViruScan V72+
Removal Instructions: See below
General Comments:
The Bloody! Virus was submitted in December 1990, and infection
reports were received from Europe, Taiwan, and the United States. This
virus is a memory resident infector of floppy diskette boot sectors as
well as the hard disk partition table.
When a system is booted from a floppy or hard disk infected with the
Bloody! Virus, the virus will install itself memory resident at the
top of system memory but below the 640K DOS boundary. Total system
memory and available free memory will decrease by 2,048 bytes. The
interrupt 12 return will be moved. The system boot will also take
much longer than expected. The system's hard disk's partition table
Brain
Pakistani, Pakistani Brain
Common
1986
Extended boot time, Volume label change, Resident TOM,
Three contiguous bad sectors (floppy only), BSC
Origin:
Pakistan
Eff Length: N/A
Type Code: BRt - Resident Boot Sector Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: MDisk, CleanUp, F-Prot, Pro-Scan, NAV, or
DOS SYS command
General Comments:
Cascade-B
Blackjack, 1704-B
Common
.COM file growth, TSR, random reboots
Germany
1,704 bytes
Casino
New
April, 1991
.COM growth; decrease in total system & available free memory;
File allocation errors
Origin:
Unknown
Eff Length: 2,330 bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Casino Virus was submitted in April, 1991 by David Chess of IBM.
This virus is a memory resident infector of .COM files, including
COMMAND.COM.
The first time a program infected with Casino is executed, Casino will
install itself memory resident at the top of system memory. Total
system and available free memory, as indicated by the DOS ChkDsk
program will decrease by 37,568 to 37,632 bytes. 3,152 bytes in low
system memory will also be used by the virus, and interrupts 00, 23,
and 30 will point to this area. After Casino is resident, it will
then immediately infect COMMAND.COM located in the C: drive root
directory.
After Casino is memory resident, it will infect .COM programs when
any of three events occur. If the system user issues a DIR command,
or a program does an internal DIR command, one .COM file in the
current directory will be infected. Additionally, if the system user
executes an infected program, a .COM program will become infected.
Lastly, Casino will infect .COM programs that are openned by another
program for any reason.
Programs infected with Casino will have a file length increase of
2,332 to 2,346 bytes. The file length increase, however, is mostly
hidden if the virus is memory resident. With the virus memory resident,
infected files will have a file length increase of 1 to 16 bytes, but
occasionally one may show a file length increase of up to 48 bytes.
The virus does not alter the file date and time in the disk directory.
If Casino is memory resident and the DOS ChkDsk program is executed,
file allocation errors will be returned for each infected program. If
the ChkDsk /F option is used, program corruption will occur.
It is unknown if Casino does anything besides replicate.
following messages:
"Welcome to the New Dungeon"
"Chaos"
"Letz be cool guys"
The Chaos virus will flag the disk as being full of bad
sectors upon activation, though most of the supposed bad
sectors are still readable. It is unknown what the
activation criteria is.
Virus Name: Christmas In Japan
Aliases:
Xmas In Japan
V Status:
Rare
Discovery: September, 1990
Symptoms:
.COM file growth; Message
Origin:
Taiwan
Eff Length: 600 Bytes
Type Code: PNCK - Resident Non-Resident .COM Infector
Detection Method: ViruScan V67+, Pro-Scan 2.01+
Removal Instructions: Scan/D, Pro-Scan 2.01+, or Delete infected files
General Comments:
The Christmas In Japan Virus was isolated in Taiwan in late September,
1990. As of early October, it is reported to be widespread in Japan.
This virus is a 600 byte non-resident generic infector of .COM files.
It will infect COMMAND.COM.
When a program infected with the Christmas In Japan Virus is executed,
the virus will infect zero to one other .COM file in the current
directory. If a file is infected, it will increase in length by
600 bytes, with the virus being located at the end of the infected
file.
On December 25, if an infected file is executed, the following message
will be displayed in the center of the screen:
"A merry christmas to you"
The message will flash and will be underlined for approximately half
the time it is displayed. If left alone, the message will go away
after a little while and the program will execute normally, but the
message will return when another infected .COM file is executed.
This virus does not appear to do any malicious damage.
Virus Name: Christmas Virus
Aliases:
Tannenbaum, XA1, 1539
V Status:
Endangered
Discovery: March, 1990
Symptoms:
.COM file growth, display, Partition table destruction
Origin:
Germany
Eff Length: 1,539 Bytes
Type Code: PNCX - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V61+, VirexPC, VirHunt 2.0+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, VirHunt 2.0+, Pro-Scan 2.01+, NAV,
or delete infected files
General Comments:
The Christmas Tree, or XA1, Virus was first isolated in March 1990
Crash
1075
Rumored
December, 1991
USSR
1,075 bytes
Type Code:
Detection Method: ViruScan V76+
Removal Instructions: Delete infected files
General Comments:
The Crash or 1075 Virus has had many samples submitted over the last
few months. The original samples were from the USSR in December, 1990.
All submitted samples of this "virus" do not replicate on an XT or 386
based personal computer. Instead, the system crashes when the sample
file is executed. It may replicate under some other system
configurations.
Virus Name: Crew-2480
Aliases:
2480
V Status:
Rare
Discovery: February, 1991
Symptoms:
.COM growth; File date/time changes; System hangs; System reboots
Origin:
Unknown
Eff Length: 2,480 bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Crew-2480 Virus was submitted in February, 1991. Its origin, or
isolation point is unknown. This virus is a non-memory resident
infector of .COM programs over 10K in size. It will infect COMMAND.COM.
When a program infected with the Crew-2480 Virus is executed, the virus
may infect one .COM file over 10K in size. When COMMAND.COM is infected
by the virus, the system will reboot. Infected .COM programs will
increase in size by 2,480 bytes with the virus being located at the
end of the infected program. The file's date and time in the disk
directory will have been updated to the system date and time when
infection occurred.
Besides the symptoms indicated above which occur when files are infected,
systems with a Crew-2480 infection may also experience system hangs
when the user attempts to execute infected programs. Later execution
of the same program may be successful. This virus may also display
a formatted message on some systems in place of the system hang which
occurs on monochrome systems.
Virus Name: Dark Avenger
Aliases:
Black Avenger, Eddie, Diana
V Status:
Common
Discovery: September, 1989
Symptoms:
TSR; .COM, .EXE, .SYS file growth; File/Disk Corruption
Origin:
Bulgaria
Isolated:
Davis, California, USA
Eff Length: 1,800 bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V36+, F-Prot, IBM Scan, Pro-Scan, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: CleanUp, Pro-Scan 1.4+, F-Prot, VirHunt 2.0+, NAV
General Comments:
Dark Avenger was first isolated in the United States at the University
of California at Davis. It infects .COM, .EXE, and overlay files,
including COMMAND.COM. The virus will install itself into system
memory, becoming resident, and is extremely prolific at infecting
any executable files that are openned for any reason. This includes
using the DOS COPY and XCOPY commands to copy uninfected files, both
the source and the target files will end up being infected. Infected
files will have their lengths increased by 1,800 bytes.
The Dark Avenger Virus does perform malicious damage. The virus
maintains a counter in the disk's boot sector. After each sixteenth
file is infected, the virus will randomly overwrite a sector on the
disk with a copy of the disk's boot sector. If the randomly
selected sector is a portion of a program or data file, the program
or data file will be corrupted. Programs and data files which have
been corrupted by a sector being overwritten are permanently
damaged and cannot be repaired since the original sector is lost.
If you are infected with Dark Avenger, shutdown your computer
and reboot from a Write Protected boot diskette for the system,
then carefully use a disinfector, following all instructions.
Be sure to re-scan the system for infection once you have finished
disinfecting it.
The Dark Avenger virus contains the words: "The Dark Avenger,
copyright 1988, 1989", as well as the message: "This program
was written in the city of Sofia. Eddie lives.... Somewhere in
Time!".
This virus bears no resemblance or similarity to the Jerusalem
viruses, even though they are similar in size.
Known variant(s) of Dark Avenger are:
Dark Avenger-B : Very similar to the Dark Avenger virus, the major
difference is that .COM files will be reinfected, adding
1,800 bytes to the file length with each infection. This
variant also becomes memory resident in high system memory
instead of being a low system memory TSR. Text strings
found in the virus's code include:
"Eddie lives...somewhere in time!"
"Diana P."
"This program was written in the city of Sofia"
"(C)1988-1989 Dark Avenger"
Also see: V2000, V1024, V651
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Datacrime
1168, Columbus Day
Extinct
April, 1989
.COM file growth, floppy disk access; formats
hard disk, message any day from Oct 13 to Dec 31.
Origin:
Holland
Eff Length: 1,168 bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: AntiCrim, Scan/D/X, Pro-Scan 1.4+, VirexPC, F-Prot,
VirHunt 2.0+, NAV
General Comments:
The Datacrime virus is a parasitic virus, and is also known as
the 1168 virus. The Datacrime virus is a non-resident
virus, infecting .COM files. The virus was originally
Datacrime-B
1280, Columbus Day
Extinct
April, 1989
.EXE file growth, formats MFM/RLL hard drives, odd
floppy disk access.
Origin:
Netherlands
Eff Length: 1,280 bytes
Type Code: PNE - Parasitic Non-Resident Generic .EXE Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: AntiCrim, Scan/D/X, VirexPC, Pro-Scan 1.4+, F-Prot,
VirHunt 2.0, NAV
General Comments:
The Datacrime-B virus is a variant of the Datacrime virus, the
differences being that the effective length of the virus is
1,280 bytes, and instead of infecting .COM files, .EXE files
are infected.
Also see: Datacrime, Datacrime II, Datacrime II-B
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
DataLock
DataLock 1.00, V920
Common
November, 1990
.EXE & COMMAND.COM file growth; decrease in system and available
memory; file date/time changes
Origin:
USA
Eff Length: 920 bytes
Type Code: PRtEK - Parasitic Resident .EXE and COMMAND.COM Infector
Detection Method: ViruScan V71+, Pro-Scan 2.01+
Removal Instructions: Clean-Up V71+, or Delete infected files
General Comments:
dBASE
DBF Virus
Extinct
September, 1988
.COM & .OVL file growth, corrupt .DBF files, TSR, FAT and root
directory overwritten
Origin:
New York, USA
Eff Length: 1,864 bytes
Type Code: PRC - Parasitic Resident .COM and Overlay Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: Scan/D/X, Pro-Scan 1.4+, F-Prot, VirHunt 2.0+, NAV
General Comments:
The dBASE virus was discovered by Ross Greenberg of New York.
This virus infects .COM & .OVL files, and will corrupt data in
.DBF files by randomly transposing bytes in any open .DBF file.
It keeps track of which files and bytes were transposed in a
hidden file (BUG.DAT) in the same directory as the .DBF file(s).
The virus restores these bytes if the file is read, so it
appears that nothing is wrong. Once the BUG.DAT file is 90
days old or more, the virus will overwrite the FAT and root
directory on the disk.
After this virus has been detected, if you remove the infected
dBASE program and replace it with a clean copy, your DBF files
that were openned during the period that you were infected
will be useless since they are garbled on the disk even
though they would be displayed as expected by the infected
dBASE program.
Virus Name:
Aliases:
V Status:
Discovered:
Deicide
Glenn
Rare
February, 1991
Symptoms:
.COM files overwritten; Message; FAT Corruption; System hang
Origin:
Netherlands
Eff Length: 666 Bytes
Type Code: ONC - Overwriting Non-Resident .COM Infector
Detection Method:
Removal Instructions: Delete Infected Programs
General Comments:
The Deicide Virus was received in February, 1991 from the Netherlands.
This virus is a non-resident overwriting virus which infects .COM files,
but not COMMAND.COM.
When a program infected with Deicide is executed, the virus will
search the current directory for an uninfected .COM program. If an
uninfected .COM program is found, the virus will infect it, overwriting
the first 666 bytes of the program with the virus. If the newly
infected program's original file length was 666 bytes or more, then no
file length change will show in the disk directory. If originally the
program was smaller than 666 bytes, its length will now be 666 bytes.
The following message may be displayed by the virus after infecting
a file:
"File corruption error."
If the virus does not find an uninfected .COM program in the current
directory, it will display the following message double spaced, and
overwrite the first 80 sectors of the system hard disk:
"DEICIDE!
Glenn (666) says : BYE BYE HARDDISK!!
Next time be carufull with illegal stuff"
The above messages can be found in all infected files, along with the
following message which is not displayed:
"This experimental virus was written by Glenn Benton
to see if I can make a virus while learning machinecode
for 2,5 months. (C) 10-23-1990 by Glenn.
I keep on going making virusses."
Virus Name: Den Zuk
Aliases:
Search, Venezuelan
V Status:
Common
Discovered: September, 1988
Symptoms:
Message, floppy format, TSR, BSC
Origin:
Indonesia
Eff Length: N/A
Type Code: RtF - Resident Floppy Boot Sector Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, VirexPC, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: MDisk, CleanUp, F-Prot, Pro-Scan 1.4+, NAV,
or DOS SYS command
General Comments:
The Den Zuk virus is a memory-resident, boot sector infector of
360K 5 1/4" diskettes. The virus can infect any diskette
in a floppy drive that is accessed, even if the diskette is
not bootable. If an attempt is made to boot the system with an
infected non-system disk, Den Zuk will install itself into
memory even though the boot failed. After the system is booted
with an infected diskette, a purple "DEN ZUK" graphic will appear
Dir Virus
Rare
January, 1991
.COM growth; TSR; Sluggishness of DIR commands;
File allocation errors
Origin:
USSR
Eff Length: 691 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
PROCESSING
Now you can turn off the power. I wish you Luck!"
It is important to note that when the message is displayed, if the
system is turned off immediately it may be possible to salvage
some files on the disk using various utility programs as this
virus first destroys the boot, FAT, and directory blocks.
Disk Killer can be removed by using McAfee Associate's MDisk or
CleanUp utility, or the DOS SYS command, to overwrite the boot
sector on hard disks or bootable floppies. On non-system floppies,
files can be copied to non-infected floppies, followed by reformatting
the infected floppies. Be sure to reboot the system from a
write protected master diskette before attempting to remove the
virus first or you will be reinfected by the virus in memory.
Note: Disk Killer may have damaged one or more files on the disk
when it wrote a portion of its viral code to 3 blocks on the disk.
Once the boot sector has been disinfected as indicated above, these
corrupted files cannot reinfect the system, however they should be
replaced with backup copies since the 3 blocks were overwritten.
Note: Do not use the DOS DiskCopy program to backup infected
diskettes as the new backup diskettes will contain the virus
as well.
Virus Name: Do-Nothing Virus
Aliases:
The Stupid Virus
V Status:
Extinct
Discovered: October, 1989
Symptoms:
.COM file growth, TSR (see text)
Origin:
Israel
Eff Length: 608 Bytes
Type Code: PRfC - Parasitic Resident .COM Infector
Detection Method: ViruScan/X V67+, F-Prot, Pro-Scan, VirexPC, AVTK 3.5+,
NAV
Removal Instructions: Scan/D/X, Pro-Scan 1.4+, F-Prot, or NAV
General Comments:
This virus was first reported by Yuval Tal of Israel in
October, 1989. The virus will infect .COM files, but only the
first one in the current directory, whether it was previously
infected or not. The Do-Nothing virus is also memory
resident, always installing itself to memory address
9800:100h, and can only infect systems with 640K of memory.
The virus does not protect this area of memory in any way,
and other programs which use this area will overwrite it in
memory, removing the program from being memory resident.
The Do-Nothing virus does no apparent damage, nor does it
affect operation of the system in any observable way, thus
its name.
Also see: Saddam
Virus Name: Dot Killer
Aliases:
944, Point Killer
V Status:
Rare
Discovered: October, 1990
Symptoms:
.COM growth; removal of all dots (.) from display
Origin:
Koszalin, Poland
Eff Length: 944
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V72+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Dot Killer Virus was isolated in Koszalin, Poland in October, 1990.
It is a non-resident infector of .COM files, including COMMAND.COM.
When a program infected with the Dot Killer Virus is executed, the
virus will infect one other .COM file in the current directory.
Infected .COM files will increase in length by 944 bytes. The virus
will be located at the end of infected files.
While the Dot Killer Virus contains code to attempt to avoid infecting
the program pointed to by the COMSPEC environmental parameter, this
logic contains a bug and does not function properly. If COMMAND.COM,
or the program pointed to by COMSPEC, is located in the current
directory it will become infected just like any other .COM program.
When the Dot Killer Virus activates, it will remove all dots (.) from
the system display.
Virus Name: Dutch 555
Aliases:
555
V Status:
Rare
Discovered: November, 1990
Symptoms:
.COM & .EXE growth; Decrease in system and available memory
Origin:
Netherlands
Eff Length: 555 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V75+
Removal Instructions: Scan/D, or Delete Infected Files
General Comments:
The Dutch 555 Virus was received in February 1991 from Righard
Zwienenberg of the Netherlands. This virus was accidently released
into the public domain by its author in November, 1990. It is a
memory resident infector of .COM and .EXE files, including COMMAND.COM.
The first time a program infected with the Dutch 555 Virus is executed,
the virus will install itself memory resident at the top of system
memory, but below the 640K DOS boundary. The interrupt 12 return is
not moved, though the DOS ChkDsk program will show a decrease in total
system and available free memory of 560 bytes. Interrupt 21 will be
hooked by the virus.
Once the Dutch 555 Virus is memory resident, it will infect .COM and
.EXE files, including COMMAND.COM, as they are executed. Infected files
will increase in size by 555 bytes, with the virus being located at the
end of the infected file.
This virus does not do anything besides replicate.
Virus Name: EDV
Aliases:
Cursy, Stealth Virus
V Status:
Rare
Discovered: 1988
Symptoms:
BSC; partition table corruption; unusual system crashes
Origin:
France
Eff Length: N/A
Type Code: BRX - Resident Boot Sector/Partition Table Infector
Detection Method: ViruScan V58+, IBM Scan, Pro-Scan 1.4+, VirHunt 2.0+, NAV
Removal Instructions: MDisk/P, CleanUp V67+, Pro-Scan 1.4+, or NAV
General Comments:
The EDV, or Cursy, Virus was first discovered in Le Havre, France in
1988 by Jean-Luc Nail. At that time, it was named the Cursy Virus.
Later, in January 1990, it was isolated separately and named the
EDV virus. This virus is a memory resident infector of floppy
diskette boot sectors and hard disk partition tables.
When a system is booted from a diskette infected with the EDV virus,
the virus will install itself memory resident at the top of high
system memory. The value returned by interrupt 12 will be decreased.
Once the virus is memory resident, and disk accessed by the system
will become infected. When the virus infects a diskette, it moves
the original boot sector to side 1, track 39, sector 8. After
moving the original boot sector, it then copies the virus's code
to absolute sector 0, the boot sector of the diskette.
EDV will also infect hard disk drives when they are accessed. In the
case of hard disks, the virus will move absolute sector 0 (the
partition table) to side 1, track 39, sector 8 as though it were a
360K 5.25" floppy diskette. After moving the partition table, it will
then overwrite the partition table with the viral code.
Once the virus has infected six disks with the virus in memory, the
EDV virus will activate. Upon activation, the virus access the
keyboard interrupt to disable the keyboard and then will overwrite
the first 3 tracks of each disk on the system, starting with the
hard disks. After overwriting the disks, it will then display the
following message:
"That rings a bell, no? From Cursy"
Upon activation, the user must power off the machine and reboot from
a system diskette in order to regain any control over the machine.
The following identification string appears at the very end of the
boot sector on infected floppy disks and the partition table of
infected hard drives, though it cannot be seen if the virus is
in memory:
"MSDOS Vers. E.D.V."
Jean-Luc Nail has indicated that the EDV or Cursy virus is quiet
common in the Le Havre area of France, although it is rare outside
of France.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Eight Tunes
1971
Rare
April, 1990
file growth, music, decrease in available memory
Origin:
West Germany
Eff Length: 1,971 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V62+, Pro-Scan 1.4+, VirexPC, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D, VirHunt 2.0+, NAV, or delete infected files
General Comments:
The Eight Tunes, or 1971, Virus was originally isolated in April
1990 by Fridrik Skulason of Iceland. This virus is a memory resident
generic file infector of .COM, .EXE, and overlay files. The virus will
not infect COMMAND.COM, or .COM files which are smaller than 8K.
After the virus is memory resident, programs are infected as they
are executed. Infected files will increase in length by between
1,971 - 1,985 bytes.
Available memory will decrease by 1,984 bytes when the virus is
present.
This virus does not cause system damage, however it is disruptive.
When the virus is memory resident, it will play 8 German folk songs
at random intervals thirty minutes after the virus becomes memory
resident.
Virus Name: Enigma
Aliases:
Cracker Jack
V Status:
Rare
Discovered: February, 1991
Symptoms:
.EXE growth
Origin:
Italy
Eff Length: 1,755 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan V76+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Enigma Virus was submitted in February, 1991, by Alberto Colusa of
Italy. This virus is a non-resident infector of .EXE files. The
original submitted sample of this virus was not a natural infection of
the virus, being on a .COM file, so the virus may actually be a
research virus.
When a program infected with Enigma is executed, one .EXE program in
the current directory will be infected by the virus. Infected .EXE
programs will increase in length by 1,755 bytes. The virus will be
located at the end of infected programs. Infected programs will also
contain the following text strings:
"This is the voice of the Enigma virus......
the spirits of the hell are coming back!"
"(C) 1991 by Cracker Jack * Italy * *.exe"
"newenigmavir"
It is not known if Enigma does anything besides replicate.
Also see: Yankee 2
Virus Name: Evil
Aliases:
P1, V1701New
V Status:
Rare
F-Word Virus
Fuck You
Rare
December, 1990
.COM growth; decrease in system and available free memory;
file date/time changes
Origin:
USSR
Eff Length: 417 Bytes
Type Code: PRtCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The F-Word, or Fuck You, Virus was submitted in December, 1990 and
is from the USSR. This virus is a memory resident infector of COM
files, including COMMAND.COM.
The first time a program infected with the F-Word Virus is executed
the virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Interrupt 12's return will
be moved. Total system memory and available free memory will decrease
by 1,024 bytes. Interrupts 08 and 21 will be hooked by the virus.
After F-Word is memory resident, it will
approximately 2K in length when they are
have a length increase of 417 bytes with
end of the program. The file's date and
have been changed to the system date and
Father Christmas
Choinka
Rare
November, 1990
.COM growth; lost cluster; cross-linking of files;
graphic and message displayed on activation
Origin:
Poland
Eff Length: 1,881 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D, or delete infected files
General Comments:
The Father Christmas, or Choinka, Virus was discovered in Poland in
Fish Virus
European Fish Viruses, Fish 6, Stealth Virus
Rare
May 1990
.COM & .EXE growth, monitor/display flickering, system
memory decrease
Origin:
West Germany
Eff Length: 3,584 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, VirexPC, F-Prot 1.12+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D, CleanUp V66+, Pro-Scan 1.4+, VirHunt 2.0+,
NAV, or delete infected files
General Comments:
The Fish Virus was isolated in May 1990. At the time of isolation,
it was reported to be widespread in Europe, and it is thought to
have originated in West Germany. It is a generic resident .COM
and .EXE infector, and will infect COMMAND.COM. This virus will
remain memory resident thru a warm reboot, or Ctrl-Alt-Del. The
virus is encrypted, though infected programs can be found by
searching for the text string "FISH FI" appearing near the end of
the program. The "FISH FI" string may later disappear from the
program.
The first time a program infected with the Fish Virus is executed,
the virus will go memory resident, installing itself into the low
available free memory. If interrupt 13 has not been hooked by
another program, it will hook interrupt 13. If it can hook
interrupt 13, it will take up 8,192 bytes in memory. If the virus
cannot hook interrupt 13 because another program is already using it,
it will be 4,096 bytes in memory.
When interrupt 13 is not hooked, and the virus is memory resident,
the virus will cause a random warm reboot, thus allowing it to
infect COMMAND.COM and hook interrupt 13. Warm reboots do not
appear to randomly occur after interrupt 13 has been hooked.
After the virus is memory resident, all .COM and .EXE programs which
are openned for any reason will be infected. Infected programs
increase in length by 3,584 bytes. The increase in program size
cannot be seen by listing the disk directory if the virus is in
memory. Also, if a CHKDSK command is run on an infected system,
it will detect file allocation errors on infected files. If CHKDSK
is run with the /F option, it will result in lost clusters and
cross-linking of files.
The virus slows down video writes, and flickering of the monitor
display can be noticed on an infected system.
Anti-viral programs which perform CRC checking cannot detect the
infection of the program by the Fish Virus if the virus is memory
Flash
Rare
July 1990
.COM & .EXE growth, decrease in available free memory,
video screen flicker
Origin:
West Germany
Eff Length: 688 Bytes
Type Code: PRfA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V64+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, Pro-Scan 2.01+, NAV, or Delete infected files
General Comments:
The Flash Virus was discovered in July 1990 in West Germany. Flash
is a memory resident generic file infector, and will infect .COM and
.EXE files, but not COMMAND.COM.
The first time a program infected with the Flash Virus is executed,
the virus will install itself memory resident. 976 bytes will be
allocated in high memory, and available free memory will decrease by
a corresponding 976 bytes. A mapping of memory will also indicate
that when Flash is resident in memory, interrupts 00, 23, 24, 30,
ED, F5, and FB are now in free memory. Total system memory reported
by DOS, as well as low memory used by the operating system and TSRs
will not have changed.
Once Flash is memory resident, each time a .COM or .EXE program is
executed it is a candidate for infection. An uninfected .EXE program
will always be infected upon execution. Uninfected .COM files are
only infected if they are greater than approximately 500 bytes in
length. Infected files will always increase in length by 688 bytes.
After June of 1990, systems with a graphics capable monitor may notice
a screen flicker occurring at approximately seven minute intervals.
The virus causes this effect by manipulating some screen blanking bits
every seven minutes.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Flip
Rare
July 1990
.COM & .EXE growth; decrease in system and free memory;
boot sector and partition table altered; file allocation errors
Origin:
West Germany
Eff Length: 2,343 Bytes
Type Code: PRhABKX - Parasitic Resident .COM, .EXE, Partition Table Infector
Detection Method: ViruScan V66+, F-Prot 1.12+, Pro-Scan 2.01+, NAV
Frere Jacques
Frere Virus
Rare
May 1990
.COM & .EXE growth, available memory decreases, system hangs,
music (Frere Jacques) on Fridays
Origin:
California, USA
Eff Length: 1,808 Bytes
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, F-Prot 1.12+, NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, NAV, or Delete infected files
General Comments:
The Frere Jacques Virus was isolated in May, 1990. It is a memory
resident generic file infector, infecting .COM, .EXE, and Overlay
files. It does not infect COMMAND.COM. This virus is based on
the Jerusalem B Virus.
The first time an infected program is executed, the virus will
install itself memory resident in low available free memory.
The memory resident virus occupies 2,064 bytes, and attaches itself
to interrupt 21. After becoming memory resident, Frere Jacques will
infect any program which is then executed. Infected programs will
increase in size by between 1,808 bytes and 1,819 bytes, though
.COM files always increase in size by 1,813 bytes.
Systems infected with Frere Jacques will experience a decrease in
available free memory, as well as executable files increasing in
size. System hangs will also intermittently occur when the virus
Frog's Alley
Frog
New
March, 1991
.COM growth; Message; FAT & Directory damage; programs disappear;
Disk Volume Label change; long disk access times
Origin:
USA
Eff Length: 1,500 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V76+
Guppy
Rare
October, 1990
TSR, .COM growth, error messages, disk boot failures
United States
including COMMAND.COM.
When a program infected with Hybryd is executed, the virus will
look for an uninfected .COM program in the current directory. If an
uninfected program is found, the virus will infect it. Infected
.COM programs will have a file length increase of 1,306 bytes, the
virus will be located at the end of the infected program. This virus
alters the file time so that the seconds field in the file time is 62,
the indicator that the file is infected. Just viewing the directory,
though, it appears that the file date and time has not been altered.
The following text strings are contained within the Hybryd Virus, though
they cannot be viewed in infected files as they are encrypted:
"(C) Hybryd Soft
Specjalne podziekowania dla
Andrzeja Kadlofa i Mariusza Deca
za artykuly w Komputerze 11/88"
In the submitted sample, the one text string that is not encrypted is
the following, which is also found in replicated samples:
"Copyright IBM Corp 1981,1987
Licensed Material - Program Property of IBM"
This string should not be taken to indicate that IBM necessarily had
anything to do with the creation of this virus.
On Friday The 13ths starting in 1992, this virus will overwrite the
current drive's boot sector when an infected program is executed. It
may also corrupt program files at that time when they are executed.
Virus Name: Hymn
Aliases:
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM & .EXE growth; decrease in system and available free memory
Origin:
USSR
Eff Length: 1,865 Bytes
Type Code: PRhA - Resident Parasitic .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Hymn Virus was submitted in December, 1990, and originated in the
USSR. This virus is a memory resident infector of .COM and .EXE files,
and will infect COMMAND.COM.
The first time a program infected with the Hymn Virus is executed, the
virus will install itself memory resident at the top of system memory
but below the 640K DOS boundary. The DOS ChkDsk program will show that
total system memory and available free memory have decreased by 3,712
bytes. This virus does not move the interrupt 12 return. COMMAND.COM
will also become infected at this time.
Once Hymn is memory resident, it will infect .COM and .EXE files which
are over approximately 2K in length when they are executed or openned
for any reason. Infected .COM files will increase in length by
1,865 bytes. Infected .EXE files will have a file length increase of
1,869 to 1,883 bytes. In both cases the virus will be located at the
Icelandic-II
System Virus, One In Ten
Extinct
July, 1989
.EXE growth, Resident TOM, FAT corruption
date changes, loss of Read-Only
Origin:
Iceland
Eff Length: 632 Bytes
Type Code: PRfE - Parasitic Resident .EXE Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Icelandic-III
December 24th
Endangered
December, 1989
.EXE growth, Resident TOM, bad sectors, FAT corruption,
Dec 24 message.
Origin:
Iceland
Eff Length: 853 Bytes
Type Code: PRfE - Parasitic Resident .EXE Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: F-Prot, Scan/D/X, Pro-Scan 1.4+, VirexPC 1.1B,
VirHunt 2.0+, NAV, or delete infected files
General Comments:
The Icelandic-III Virus is a modified version of the Icelandic
Virus, and was isolated for the first time in December 1989 in
Iceland. These two viruses are very similar, so only the
changes to this variant are indicated here, refer to Icelandic
for the base virus information.
The Icelandic-III virus's id string in the last 2 words of the
program is hex '1844,195F', the bytes in each word being
reversed from the id string ending the Icelandic and
Icelandic-II viruses. There are also other minor changes to
the virus from the previous Icelandic viruses, including the
addition of several NOP instructions.
Before the virus will infect a program, it checks to see if the
program has been previously infected with Icelandic or
Icelandic-II, if it has, it does not infect the program.
Files infected with the Icelandic-III virus will have their
length increased by between 848 and 863 bytes.
If an infected program is run on December 24th of any year,
programs subsequently run will be stopped, later displaying
After the virus has become memory resident, any .COM or .EXE file
(with the exception of COMMAND.COM) openned will be infected by the
virus. Infected .COM files will increase in length by 4,096 bytes
with the viral code being located at the beginning of the infected
file. .EXE files will increase in length between 4,096 and 4,110
bytes with the viral code being located at the end of the infected
file.
Additionally, any non-write protected diskettes which are exposed to
the infected system will have their boot sectors infected.
The Invader Virus activates after being memory resident for
30 minutes. At that time, a melody may be played on the system
speaker. On systems which play the melody, it will continue until
the system is rebooted. The melody isn't played on 286 based systems,
but is noticeable on the author's 386SX test machine.
Also see: Plastique, Plastique-B
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Iraqui Warrior
Iraqui
Rare
January, 1991
.COM growth; Closely spaced beeps from system speaker;
system hangs; boot failures
Origin:
USA
Eff Length: 777 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Iraqui Warrior Virus was isolated on January 17, 1991 in the
United States. This virus is a non-memory resident infector of .COM
files, including COMMAND.COM. It is based on the Vienna Virus.
When a program infected with the Iraqui Warrior Virus is executed, the
virus will infect one of the first four .COM files located on the
current drive and current directory. Infected .COM files will have
a file length increase of 777 bytes with the virus being located at the
end of the file.
The following text strings can be found in infected files, the first
two occurring near the beginning of the virus, and the last being
located very near the end of the infected file:
"I come to you from The Ayatollah!"
"(c)1990, VirusMasters"
"An Iraqui Warrior is in your computer..."
None of these messages are displayed by the virus.
Systems infected with the Iraqui Warrior virus may occassionally
experience the system speaker issuing a series of closely spaced beeps
when an infected program is executed. When this occurs, the system
will hang and have to be rebooted. The beeps continue until the reboot
occurs.
Booting from a disk where COMMAND.COM has been infected will result in
a "Memory allocation error, Cannot start COMMAND, exiting" message
appearing.
The Iraqui Warrior does not appear to do anything else besides the
above.
Virus Name: Italian 803
Aliases:
V Status:
New
Discovered: March, 1991
Symptoms:
.COM & .EXE growth
Origin:
Italy
Eff Length: 803 Bytes
Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Italian 803 Virus was submitted in March, 1991. This virus is a
non-resident direct action infector of .COM and .EXE files. It will
infect COMMAND.COM.
When a program infected with Italian 803 is executed, the virus will
look for an uninfected .EXE file in the current directory to infect.
If one is found, it will become infected. If an uninfected .EXE file
does not exist in the current directory, the virus will then look for
an uninfected .COM file in the current directory. If an uninfected
.COM file is found, it will then be infected.
Programs infected with Italian 803 will have a file length increase
of 803 to 817 bytes with the virus being located at the end of the
infected file. This virus does not alter the file date and time in the
disk directory.
The Italian 803 Virus may reinfect programs already infected with this
virus. The reinfection only occurs when an infected program is copied,
and then another infected program is executed. Reinfections of Italian
803 will result in an additional 816 bytes being added to the file.
Italian 803 does not do anything besides replicate.
Known variant(s) of Italian 803 include:
Italian 803-B: Similar to Italian 803, this variant differs by only
1 byte.
Virus Name: Itavir
Aliases:
3880
V Status:
Endangered
Discovered: March, 1990
Symptoms:
.EXE growth, COMMAND.COM file, Boot sector corruption
Origin:
Italy
Eff Length: 3,880 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan V60+, Pro-Scan 1.4+
Removal Instructions: Scan/D, or delete infected files
General Comments:
The Itavir virus was isolated in March 1990 by a group of
students at the Milan Politechnic in Milan, Italy. The Itavir
virus is a non-resident generic .EXE Infector. Infected files
will increase in length by 3,880 bytes. Infected systems,
General Comments:
The Jerk, Talentless Jerk, or SuperHacker Virus was submitted in
March, 1991. Its origin is unknown. This virus is a non-memory
resident infector of .COM and .EXE programs, and it will infect
COMMAND.COM.
When a program is executed which is infected with the Jerk Virus, it
will search the directory structure of the C: drive to find a program
to infect. If the user executed the infected program from a diskette,
an unexpected access to the system hard disk will occur. Once the
virus has selected a .COM or .EXE program to infect, it will alter the
first nine bytes of the candidate file, and then append the virus to the
end of the newly infected program. The following message may also be
displayed on the system monitor, though this does not always occur:
"Craig Murphy calls himself SUPERHACKER but he's just a talentless jerk!"
This message cannot be seen within infected programs as it is
encrypted within the virus.
Programs infected with the Jerk Virus will have a file length increase
of 1,077 bytes. The text string "MURPHY" will also be found starting
at the fourth byte of the infected file. The other text string which
can be found in infected files is:
"COMMAND.COM *.COM *.EXE Bad command or file name"
The Jerk Virus does not do anything besides replicate.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Jerusalem
PLO, Israeli, Friday 13th, Russian, 1813(COM), 1808(EXE)
Common
October, 1987
TSR, .EXE & .COM growth, system slowdown, deleted files
on Friday 13th, "Black WIndow"
Origin:
Israel
Eff Length: 1,813 (COM files) & 1,808 (EXE files) bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, VirexPC 1.1+,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: Scan/D/A, Saturday, CleanUp, UnVirus, F-Prot,
VirexPC 1.1+, Pro-Scan 1.4+, NAV
General Comments:
The Jerusalem Virus was originally isolated at Hebrew
University in Israel in the Fall of 1987. Jerusalem is a memory
resident infector of .COM and .EXE files, with .EXE file being
reinfected each time they are executed due to a bug in the
virus.
This virus redirects interrupt 8, and 1/2 hour after execution
of an infected program the system will slow down by a factor
of 10. Additionally, some Jerusalem Virus variants will have a
"Black Window" or "Black Box" appear on the lower left side of
the screen which will scroll up the screen as the screen scrolls.
On Friday The 13ths, after the virus is installed in memory,
every program executed will be deleted from disk.
The identifier for some strains is "sUMsDos", however,
Jerusalem B
Arab Star, Black Box, Black Window, Hebrew University
Common
January, 1988
TSR, .EXE & .COM growth, system slowdown, deleted files
on Friday 13th, "Black WIndow"
Origin:
Israel
Eff Length: 1,813 (.COM files) & 1,808 (.EXE files) bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, VirexPC 1.1+,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: F-Prot, Saturday, CleanUp, UnVirus, VirexPC 1.1+
Pro-Scan 1.4+, NAV
General Comments:
Identical to the Jerusalem virus, except that in some cases
it does not reinfect .EXE files. Jerusalem B is the most
common of all PC viruses, and can infect .SYS and program
overlay files in addition to .COM and .EXE files.
Not all variants of the Jerusalem B virus slow down the
system after an infection has occurred.
Also, it should be noted that Jerusalem viruses will only activate
if they actually become memory resident on their activation date. If
the system clock rolls over to the activation date and the virus is
already memory resident, they will not typically activate and perform
any destructive behavior they may be intended to perform.
Known variants of Jerusalem B are:
A-204
: Jerusalem B with the sUMsDos text string changed to
*A-204*, and a couple of instructions changed in order to
avoid detection. This variant will slow down the system
after being memory resident for 30 minutes, as well as having
a black box appear at that time.
Origin: Delft, The Netherlands
Anarkia
: Jerusalem B with the timer delay set to slow
down the system to a greater degree, though this effect
doesn't show until a much longer time has elapsed. No
Black Box is never displayed. The sUMsDos id-string has
been changed to ANARKIA. Lastly, the virus's activation
date has been changed to Tuesday The 13ths, instead of
Friday The 13ths. Origin: Spain
Anarkia-B : Similar to Anarkia, with the exception that the
virus now activates on any October 12th instead of on
Tuesday The 13ths.
Jerusalem-C: Jerusalem B without the timer delay to slow
down the processor.
Jerusalem-D: Jerusalem C which will destroy both copies of
the FAT on any Friday The 13th after 1990.
Jerusalem-E: Jerusalem D but the activation is in 1992.
Mendoza
: Based on the Jerusalem B virus, this variant does
not reinfect .EXE files. It is also missing the black box
effect. Mendoza activates in the second half of the year
(July - December), at which time any day will have a 10%
chance of having all programs executed deleted.
Origin: Argentina
Park ESS: Isolated in October, 1990 in Happy Camp, California, this
variant is very similar to other Jerusalem viruses. Infected
.COM files increase in length by 1,813 bytes, and infected .EXE
files will increase in length by 1,808 to 1,822 bytes with the
first infection, and 1,808 on later subsequent infections. This
variant will also infect COMMAND.COM. The other major difference
from the "normal" Jerusalem is that the sUMsDos string has been
replaced. The string PARK ESS can be found in the viral code
within all infected files. This variant slows down the system
by approximately 20 percent and a "black window" will appear after
the virus has been memory resident for 30 minutes.
Puerto : Isolated in June, 1990 in Puerto Rico, this variant is
very similar to the Mendoza variant, the virus contains the
sUMsDos id-string. .EXE files may be infected multiple times.
Skism-1 : Isolated in December, 1990 in New York State, this variant
is similar to many other Jerusalems except with regards to when
and what it does upon activation. Rather than activate on
Friday The 13ths and delete files, this variant activates in the
years 1991 and later on any Friday which occurs after the 15th of
the month. On activation, it truncates any file which is attempted
to be executed to zero bytes. COM files will increase in size
upon infection by 1,808 bytes, EXE files will increase by 1,808 to
1,822 bytes. EXE files will be reinfected by the virus. The
sUMsDos string in the virus is now SKISM-1. Like Jerusalem, this
variant produces a "black window" 30 minutes after becoming
memory resident, and also slows down the system.
Spanish JB : Similar to Jerusalem, it reinfects .EXE files.
The increased file size on .COM files is always 1,808
bytes. On .EXE files, the increased file size may be
either 1,808 or 1,813, with reinfections always adding
1,808 bytes to the already infected file. No "Black
Box" appears. The characteristic sUMsDos id-string does
not appear in the viral code. This variant is also sometimes
identified as Jerusalem E2. Origin: Spain
Jerusalem DC: Similar to Jerusalem B, this variant has the sUMsDos
text string changed to 00h characters. After being memory resident
for 30 minutes, the system will slow down by 30% and the common
"black window" will appear on the lower left side of the screen.
Like Jerusalem, it will infect .EXE files multiple times. This
variant does not carry an activation date when it will delete
files, it appears for all intents to be "defanged".
Origin: Washington, DC, USA
Captain Trips: The Captain Trips variant was submitted in March, 1991,
and is from the United States. Its name comes from the text string
"Captain Trips X." which occurs within the viral code. Unlike
most Jerusalem B variants, this variant does not display a black
window after being memory resident for 30 minutes, nor does it
slow down the system. On Friday The 13th, it does not delete
programs. The text string "MsDos" does not occur in infected
programs. .COM programs will increase in size by 1,813 bytes.
.EXE programs will increase in size by 1,808 to 1,822 bytes with
the first infection of the file, and then by 1,808 bytes with
subsequent infections.
Swiss 1813 : Submitted in February, 1991, from Switzerland, this
Jerusalem variant does not exihibit the "black window" after being
memory resident for 30 minutes, nor does it slow down the system.
It also does not delete programs on Friday The 13th, or any other
Friday. The sUMsDos text string has been changed to binary zeros.
Also see: Jerusalem, Frere Jacques, New Jerusalem, Payday,
Suriv 3.00, Westwood
Virus Name: JoJo
Aliases:
V Status:
Rare
Discovered: May, 1990
Symptoms:
.COM growth, system hangs
Origin:
Israel
Eff Length: 1,701 Bytes
Type Code: PRaC - Parasitic Resident .COM Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, VirexPC, F-Prot 1.12+, NAV
Removal Instructions: Scan/D, F-Prot 1.12+, Pro-Scan 2.01+
General Comments:
The JoJo virus was discovered in Israel in May, 1990. The virus'
name comes from a message within the viral code:
"Welcome to the JOJO Virus."
One other message appears within the virus, indicating that it was
written in 1990. This message is: "Fuck the system (c) - 1990".
Both messages within the viral code are never displayed.
When the first file infected with the JoJo Virus is executed on a
system, the virus will install itself memory resident. The
method used is to alter the Command Interpreter in memory,
expanding its size. As an example, on my test system, the
Command Interpreter in memory increased in size from 3,536 bytes
to 5,504 bytes. One block of 48 bytes is also reserved in
available free memory. The change in free memory will
be a net decrease of 2,048 bytes.
The JoJo Virus will not infect files if interrupt 13 is in use
by any other program. Instead the virus will clear the screen,
and the system will be hung. If the user performs a warm reboot
(Ctrl-Alt-Del), the virus will remain in memory.
Once the virus is able to become memory resident with interrupt 13
hooked, any .COM file executed will be infected by the virus.
Infected files will increase in length by 1,701 bytes.
While this virus has the same length as the Cascade/1701 Virus, it
is not a variant of Cascade.
Also see: JoJo 2
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Origin:
JoJo 2
Rare
January, 1991
.COM growth; Message; "Not enough memory" errors; system hangs;
cursor position off 1 character
United States
Like the Stoned virus, it infects the partition table of hard disks.
Similar to the Brain virus's method of redirecting all attempts to
read the boot sector to the original boot sector, Joshi does this with
the partition table.
On January 5th of any year, the Joshi virus activates. At that
time, the virus will hang the system while displaying the message:
"type Happy Birthday Joshi"
If the system user then types "Happy Birthday Joshi", the system
will again be usable.
This virus may be recognized on infected systems by powering off
the system and then booting from a known-clean write-protected
DOS diskette. Using a sector editor or viewer to look at the
boot sector of suspect diskettes, if the first two bytes of the
boot sector are hex EB 1F, then the disk is infected. The EB 1F
is a jump instruction to the rest of the viral code. The remainder
of the virus is stored on track 41, sectors 1 thru 5 on 360K
5.25 inch Diskettes. For 1.2M 5.25 inch diskettes, the viral code
is located at track 81, sectors 1 thru 5.
To determine if a system's hard disk is infected, you must look at
the hard disk's partition table. If the first two bytes of the
partition table are EB 1F hex, then the hard disk is infected. The
remainder of the virus can be found at track 0, sectors 2 thru 6.
The original partition table will be a track 0, sector 9.
The Joshi virus can be removed from an infected system by first
powering off the system, and then booting from a known-clean, writeprotected master DOS diskette. If the system has a hard disk, the
hard disk should have data and program files backed up, and the
disk must be low-level formatted. As of July 15, 1990, there are
no known utilities which can disinfect the partition table of the
hard disk when it is infected with Joshi. Diskettes are easier to
remove Joshi from, the DOS SYS command can be used, or a program
such as MDisk from McAfee Associates, though this will leave the
viral code in an inexecutable state on track 41.
Virus Name: July 13TH
Aliases:
V Status:
Endangered
Discovered: April, 1990
Symptoms:
.EXE file growth, screen effects on July 13
Origin:
Madrid, Spain
Eff Length: 1,201 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan V64+, VirexPC, F-Prot 1.12+, NAV
Removal Instructions: Scan/D, F-Prot 1.12+, or delete infected files
General Comments:
The July 13TH Virus was isolated in Madrid, Spain, in April 1990
by Guillermo Gonzalez Garcia. This virus is a generic .EXE file
infector, and is not memory resident.
When a program infected with the July 13TH Virus is executed, the
virus will attempt to infect a .EXE file. Files are only infected
if they are greater in length than 1,201 bytes. Infected files
increase in size by 1,201 to 1,209 bytes.
The July 13TH Virus activates on July 13th of any year. At that
time, a bouncing ball effect occurs on the system monitor's screen
similar to the bouncing ball effect of the Ping Pong virus. While
this virus is disruptive, it does not cause any overt damage to
files other than infecting them. The bouncing ball effect created
by this virus will occasionally leave dots on the screen where
it was passing if the screen has been scrolled for any reason.
Virus Name: June 16TH
Aliases:
Pretoria
V Status:
Endangered
Discovered: April, 1990
Symptoms:
.COM file growth, long disk accesses, June 16th FAT alteration
Origin:
Republic of South Africa
Eff Length: 879 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V62+, Pro-Scan 1.4+, VirexPC, AVTK 3.5+,
F-Prot 1.12+, VirHunt 2.0+, NAV
Removal Instructions: VirHunt 2.0+, Scan/D, Pro-Scan 2.01+, NAV
General Comments:
The June 16TH, or Pretoria, virus was discovered in April 1990.
This virus is a non-resident generic .COM file infector, and is
encrypted. The first time an infected file is executed, the virus
will search the current drive (all directories) and infect all
.COM files found. The search period can be quite long, and it is
very obvious on hard disk based systems that the program is taking
too long to load.
On June 16TH of any year, the first time an infected file is
executed the virus will activate. On activation, the virus will
change all entries in the root directory and the file allocation
table to "ZAPPED".
The June 16TH virus is thought to have originated in South
Africa.
Virus Name: Kamasya
Aliases:
V Status:
New
Discovered: March, 1991
Symptoms:
.EXE growth; decrease in total system & available memory
Origin:
USA
Eff Length: 1,098 Bytes
Type Code: PRE - Parasitic Resident .EXE Infector
Detection Method: ViruScan V76+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Kamasya Virus was submitted by David Grant of the United States in
March, 1991. The Kamasya Virus is based on the Murphy Virus from
Bulgaria. It is a memory resident infector of .EXE files.
When a program infected with the Kamasya Virus is executed, the virus
will check if it is already memory resident. If it isn't already
memory resident, it will install itself memory resident at the top
of system memory but below the 640K DOS boundary. A portion of the
virus will also be in low system memory. Interrupt 21 will be hooked
by the virus in high system memory, and interrupt 00 in low system
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Kemerovo
USSR 257, Kemerovo-B
Rare
December, 1990
.COM growth; ????????COM Path not found." message;
file date/time changes
Origin:
USSR
Eff Length: 257 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Kemerovo Virus was submitted in December, 1990 and is from the
USSR. This virus is a non-resident direct action infector of .COM
files, including COMMAND.COM.
When a program infected with the Kemerovo Virus is executed, the virus
will search the current drive and directory for a .COM program to
infect. If an uninfected COM program is found, the virus will infect
it, adding its viral code to the end of the original program. The
newly infected program's date and time in the disk directory will also
be updated to the current system date and time of infection. Infected
programs will increase in length by 257 bytes.
If an uninfected .COM file was not found in the current directory, the
message "????????COM Path not found" may be displayed and the program
the user is attempting to execute will be terminated.
Kemerovo does not do anything besides replicate.
Known variant(s) of Kemerovo include:
Kemerovo-B : Similar to Kemerovo, this variant is from the United States
and has been altered to avoid detection by some anti-viral
programs. Its major distinction from the original virus is
that it will infect five .COM programs in the current directory.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Kennedy
Dead Kennedy, 333
Endangered
April, 1990
.COM growth, message on trigger dates (see text),
crosslinking of files, lost clusters, FAT corruption
Origin:
Denmark
Eff Length: 333 Bytes
Type Code: PNCKF - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V62+, Pro-Scan 1.4+, VirexPC, F-Prot 1.12+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D, F-Prot 1.12+, VirHunt 2.0+,
or delete infected files
General Comments:
The Kennedy Virus was isolated in April 1990. It is a generic
infector of .COM files, including COMMAND.COM.
This virus has three activation dates: June 6 (assassination of
Robert Kennedy 1968), November 18 (death of Joseph Kennedy 1969),
and November 22 (assassination of John F. Kennedy 1963) of any
year. On activation, the virus will display a message the following
message:
Keypress
Common
October, 1990
.COM & .EXE growth; decrease in available free memory;
keystrokes repeated unexpectedly
Origin:
USA
Eff Length: 1,232 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V71+, Pro-Scan 2.01+
Removal Instructions: Clean-Up V71+, or Delete infected files
General Comments:
The Keypress Virus was reported and isolated in many locations in the
United States in late October, 1990. This virus is a memory resident
infector of .COM and .EXE files, including COMMAND.COM.
The first time a program infected with the Keypress Virus is executed,
the virus will install itself memory resident at the top of free
available memory, but below the 640K DOS boundary. Interrupts 1C and
21 will be hooked by the virus. Available free memory on the system
will have decreased by 1,232 bytes.
After the virus is memory resident, any file executed may become
infected by the virus. In the case of .COM files, they are only
infected if their original file length was greater than 1,232 bytes.
.EXE files of any length will be infected, as will COMMAND.COM if it
is executed. Infected programs will have their directory date/time
changed to the system date and time when they were infected by this
virus. .COM files will increase in length by between 1,234 and
1,248 bytes upon infection. .EXE files will increase by 1,472 to
1,486 bytes upon infection. In either case, the virus will be located
at the end of the infected file.
The Keypress Virus activates after being memory resident for 30 minutes.
Upon activation, the virus may interfer with keyboard input by repeating
keystrokes. For example, if "a" is entered on the keyboard, it may be
changed to "aaaaaa" by the virus.
Infected files can be identified by containing the following hex string
near the end of the infected program: 4333C98E1E2901CD21.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Korea
LBC Boot
Common - Korea
March, 1990
BSC - 360k disks
Origin:
Seoul, Korea
Eff Length: N/A
Type Code: RF - Resident Floppy Boot Sector Infector
Detection Method: ViruScan V61+, VirHunt 2.0+
Removal Instructions: M-Disk, or DOS SYS Command
General Comments:
The Korea, or LBC Boot, Virus was isolated in March 1990 in
Seoul, Korea. This virus is a memory resident boot sector
infector for 5.25" 360K diskettes.
The Korea virus is not intentionally destructive, it does nothing
in its current form except for replicating. In some instances,
when Korea infects a diskette it will damage the root directory as
it moves the original boot sector to sector 11, the last sector of
the root directory. If sector 11 previously contained directory
entries, they will be lost.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Lazy
Rare
February, 1991
.COM & .EXE growth; System slowdown; Slow screen writes;
System hangs
Origin:
Unknown
Eff Length: 720 Bytes
Type Code: PRxCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V75+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Lazy Virus was isolated in February, 1991, and its origin is
unknown. This virus is a memory resident infector of .COM files,
including COMMAND.COM.
The first time a program infected with the Lazy Virus is executed on
a system, the virus will install itself memory resident in unreserved
low system memory hooking interrupts 10 and 21. The system processor
will be significantly slowed down, resulting in very slow screen
writes occurring.
After Lazy is memory resident, it will infect .COM programs as they
are executed. Infected .COM programs will increase in size by 720
bytes with the virus being located at the end of the infected file.
The program's date and time in the disk directory will be updated to
the current system date and time when infection occurred. Infected
programs can be identified by the text string "lazy" which will occur
near the end of all infected programs.
Systems infected with the Lazy Virus may experience unexpected system
hangs. These hangs occur when some programs are executed which allocate
and overwrite the memory where the Lazy Virus resides in memory. For
example, ViruScan will hang when it checks memory if Lazy is currently
resident.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Lehigh
Lehigh University
Rare
November, 1987
Corrupts boot sector & FAT
Origin:
Pennsylvania, USA
Eff Length: N/A
Type Code: ORaKT - Overwriting Resident COMMAND.COM Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, VirexPC, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: MDisk & replace COMMAND.COM with clean copy, or
F-Prot, NAV
General Comments:
The Lehigh virus infects only the COMMAND.COM file on both
floppies and hard drives. The infection mechanism is to overwrite the stack space. When a disk which contains an
uninfected copy of COMMAND.COM is accessed, that disk is then
infected. A infection count is kept in each copy of the virus,
and after 4 infections, the virus overwrites the boot sector and
FATs.
A variation of the Lehigh virus, Lehigh-2, exists which
maintains its infection counter in RAM and corrupts the boot
sector and FATs after 10 infections.
Known variants of the Lehigh virus are:
Lehigh-2 : Similar to Lehigh, but the infection counter is maintained
in RAM, and the corruption of the boot sector and FATs
occurs after 10 infections.
Lehigh-B : Similar to Lehigh, the virus has been modified to
avoid detection.
Virus Name: Leprosy
Aliases:
Leprosy 1.00, News Flash
V Status:
Rare
Discovered: August, 1990
Symptoms:
unusual messages; program corruption
Origin:
California, USA
Eff Length: 666 Bytes
Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector
Detection Method: ViruScan/X V67+, NAV
Removal Instructions: Scan/D/X, or Delete infected files
General Comments:
The Leprosy Virus was discovered in the San Francisco Bay Area of
California on August 1, 1990. This virus is a non-resident
overwriting virus infecting .COM and .EXE files, including
COMMAND.COM. Its original carrier file is suspected to be a file
called 486COMP.ZIP which was uploaded to several BBSes.
When you execute a program infected with the Leprosy virus, the virus
will overwrite the first 666 bytes of all .COM and .EXE files in
the directory one level up from the current directory. If the
current directory is the root directory, all programs in the root
directory will be infected. If COMMAND.COM is located in the directory
being infected, it will also be overwritten. Infected files will show
no file length increase unless they were originally less than 666
bytes in length, in which case their length will become 666 bytes.
After the virus has infected the .COM and .EXE files, it will display
a message. The message will be either:
"Program to big to fit in memory"
or:
Liberty
Common
May, 1990
.COM, .EXE, .OVL growth
Origin:
Sydney, Australia
Eff Length: 2,862 Bytes
Type Code: PRfAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, VirexPC, F-Prot 1.12+,
VirHunt 2.0+, NAV
Removal Instructions: VirHunt 2.0+, Clean-Up V72+, or Delete infected files
General Comments:
The Liberty Virus was isolated in Sydney, Australia in May, 1990.
Liberty is a memory resident generic file infector, infecting
.COM, .EXE, and overlay files. COMMAND.COM may also become
infected.
The Liberty Virus gets its name from the text string "Liberty"
which will appear in all infected files. In .EXE files, it will
be located in the last 3K of the file. In .COM files, it will
appear near the very beginning of the program, as well as within the
last 3K of the infected file.
The first time a file infected with the Liberty Virus is executed,
the virus will become memory resident. Liberty installs itself
resident in high free memory, resulting in a decrease of 8,496 bytes
of available free memory. It also directly changes the interrupt
map page in memory so that interrupts 21 and 24 will put the virus in
control. Total system memory does not change.
After becoming memory resident, programs which are executed may
be infected by the virus. All .EXE files will be infected, but
only .COM files over 2K in length will become infected. Overlay
files will also become infected. Infected files will increase
in size between 2,862 and 2,887 bytes, and will end with the hex
character string: 80722D80FA81772880. The main body of the virus will
be located at the end of all infected files.
Infected .COM files can also be identified by the following text
string which will appear near the beginning of the infected program:
"- M Y S T I C - COPYRIGHT (C) 1989-2000, by SsAsMsUsEsL"
This string does not appear in infected .EXE files, the area where
this string would have appeared in infected .EXE files will be 00h
characters.
Liberty is a self-encrypting virus. It is not yet known if it
is destructive.
Known variant(s) of Liberty are:
Liberty-B : Isolated in November, 1990, this strain is functionally
similar to the original Liberty Virus. The string which
occurs at the end of all infected files has been changed
to: C8004C40464842020EB. The word "MAGIC" will also be found
repeated together many times in infected files.
Liberty-C : Isolated in January, 1991, this variant is very similar to
Liberty-B, there are 16 bytes which have been changed. Like
Liberty-B, the word "MAGIC" will be found repeated together
many times in infected files. The string which occurs at the
end of all infected files has been changed to:
C8004C404648422020E9.
Virus Name: Lisbon
Aliases:
V Status:
Rare
Discovered: November, 1989
Symptoms:
.COM growth, Unusable files (see text)
Origin:
Lisbon, Portugal
Eff Length: 648 bytes
Type Code: PNC - Parasitic Non-Resident COM Infector
Detection Method: ViruScan V49+, F-Prot, IBM Scan, Pro-Scan, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, VirexPC, F-Prot, VirHunt 2.0+,
NAV
General Comments:
The Lisbon virus is a strain of the Vienna virus first
isolated by Jean Luz in Portugal in November, 1989. The virus
is very similar to Vienna, except that almost every word in
the virus has been shifted 1-2 bytes in order to avoid virus
identification/detection programs which could identify the
Vienna virus.
1 out of every 8 infected files will have the 1st 5 bytes of
the 1st sector changed to "@AIDS", thus rendering the
program unusable.
Also see: Vienna
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Little Pieces
1374
Rare
January, 1991
.COM & .EXE growth; decrease in available free memory; message;
system hangs; unexpected screen clears
Origin:
Italy
Eff Length: 1,374 Bytes
Type Code: PRaE - Parasitic Resident .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected programs
General Comments:
The Little Pieces Virus was isolated in January, 1991, in Italy. This
virus is a 1,374 byte memory resident infector of .EXE files.
The first time a program infected with Little Pieces is executed, the
virus will install itself memory resident. The area where it is memory
resident is 1,392 bytes long and labelled COMMAND Data in low system
memory. Some memory mapping utilities will combine this area with the
command interpretor, so the command interpretor will appear to be 1,392
bytes longer than expected. Interrupts 13, 16, and 21 are hooked by
the Little Pieces Virus.
Once Little Pieces is memory resident, it will infect .EXE programs
as they are executed. Infected .EXE programs will increase in size by
1,374 bytes and have the virus located at the end of the infected
file. Infected files will not have their date and time in the disk
directory altered.
Systems infected with the Little Pieces Virus may experience the system
display being cleared unexpectedly after a key is pressed on the
keyboard. The following message is usually displayed after the
screen is cleared, though not always:
"One of these days I'm going to cut you into little pieces"
This message cannot be viewed in infected files as it is encrypted
within the virus.
Infected system may also experience unexpected system hangs occurring,
requiring the system to be rebooted. These hangs sometimes occur after
the above message is displayed.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Lozinsky
Rare
December, 1990
.COM file growth; file date/time changes;
decrease in total system and available free memory
Origin:
USSR
Eff Length: 1,023 Bytes
Type Code: PRtCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected programs
General Comments:
The Lozinsky Virus was submitted in December, 1990 from the USSR.
Lozinsky is a memory resident infector of .COM files, including
COMMAND.COM.
When the first program infected with Lozinsky is executed, the virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Interrupt 12's return will be moved so
that the system will report 2,048 bytes of memory less than what is
actually installed. Interrupts 13 and 21 will be hooked by the virus.
COMMAND.COM will also become infected at this time.
After Lozinsky is memory resident, it will infect .COM files which are
executed or openned for any reason. Infected programs will show a file
length increase of 1,023 bytes and have the virus located at the end
of the program. Their date and time in the disk directory will also
have been updated to the system date and time when the program was
infected by Lozinsky.
It is unknown if Lozinsky does anything besides replicate.
Virus Name: Mardi Bros
Aliases:
V Status:
Rare
Discovered: July, 1990
Symptoms:
BSC; volume label change; decrease in system and free memory
Origin:
France
Eff Length: N/A
Type Code: FR - Floppy Boot Sector Infector
Detection Method: ViruScan V66+
Removal Instructions: M-Disk, or DOS SYS Command
General Comments:
The Mardi Bros Virus was isolated in July 1990 in France. This virus
is a memory resident infector of floppy disk boot sectors. It does
not infect hard disk boot sectors or partition tables.
When a system is booted from a diskette infected with the Mardi Bros
Virus, the virus will install itself memory resident. It resides in
7,168 bytes above the top of memory, but below the 640K DOS Boundary.
The decrease in system and free memory can be seen using the DOS
CHKDSK command, or several other memory mapping utilities.
Mardi Bros will infect any non-write protected diskette which is
exposed to the system. Infected diskettes can be easily identified
as their volume label will be changed to "Mardi Bros". The CHKDSK
program will show the following for the diskette's Volume label
information:
"Volume Mardi Bros created ira 0, 1980 12:00a"
While the infected boot sector on the diskette will have the DOS
messages still remaining, it will also include the following phrase
near the end:
"Sudah ada vaksin"
It is unknown if Mardi Bros is destructive, it appears to do nothing
but spread.
Mardi Bros can be removed from infected diskettes by first powering
off the system and rebooting from a known clean write protected
DOS master diskette. The DOS SYS command should then be used to
replace the infected diskette's boot sector. Alternately, MDisk
can be used following the power-down and reboot.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
MG
Rare
September, 1990
.COM file growth; DIR command may not function properly;
File allocation errors; System hangs
Origin:
Bulgaria
Eff Length: 500 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The MG Virus was submitted in January, 1991, though it has been
mentioned by Bulgarian researchers several times since September, 1990.
This virus is named MG as it was originally isolated at
Matematicheska Gimnazia, a school in Varna, Bulgaria. It is a memory
resident infector of .COM files, including COMMAND.COM.
The first time a program infected with MG is executed, the virus will
install itself memory resident in a portion of the interrupt table in
memory. Interrupt 24 is hooked by the virus, as are several other
interrupts.
After MG is memory resident, it will infect programs when one of two
things occurs: either the user attempts to execute any program, or a
Dir command is performed. In the case of a program being executed, the
virus will infect one program in the current directory, though not
necessarily the program being executed. When a Dir command is executed,
one program in the current directory will be infected as well.
.COM programs infected with MG will increase in length by 500 bytes,
though the file length increase will not be visible in a dir listing
if the virus is memory resident. File date and time in the disk
directory are also not altered. The virus will be located at the end
of infected programs.
Symptoms of a MG infection are that the DOS Chkdsk program will show
File allocation errors on all infected .COM programs if the virus is
present in memory. The DOS Dir command may also not function properly,
for example DIR A:*.COM will yield "File not found" even though .COM
files exist on the A: drive. At other times, pauses will occur in the
disk directory being displayed by the Dir command. Another symptom is
that unexpected system hangs may occur due to the interrupt table being
infected in memory.
Also see: MG-2
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
MG-2
Rare
December, 1990
.COM file growth; File Allocation Errors;
Dir command may not function properly
Origin:
Bulgaria
Eff Length: 500 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The MG-2 Virus was received in December, 1990, and is believed to have
originated in Bulgaria. This virus is a direct action, memory resident
infector of .COM programs, including COMMAND.COM.
When a program infected with the MG-2 Virus is first executed, the
virus will install itself memory resident. The DOS ChkDsk command,
when executed on an infected system, will indicate that total system
memory and available free memory have decreased by 55,104 bytes. This
virus remaps many interrupts, including interrupt 24. A portion of the
virus will also be resident above 640K if memory is available.
After the MG-2 Virus is memory resident, it will infect one .COM
program in the current directory each time an infected .COM program is
executed. Infected .COM programs will not show a file length increase
if the virus is memory resident. With the virus memory resident, the
DOS ChkDsk command will indicate a file allocation error for all
infected files. Infected files actually increase 500 bytes in length
and have the virus located at the end of the infected file.
Systems infected with the MG-2 Virus may notice that the DOS Dir
command does not always return the results expected. For example,
issuing a "DIR C:\DOS" command may result in the C: drive root directory
being displayed instead of the C:\DOS directory. Another case is that
issuing the command "DIR A:*.COM" will result in "File not found" though
.COM files exist on that drive.
Known variant(s) of MG-2 are:
MG-3
: Functionally similar to MG-2, this variant has been altered
to avoid detection. It is also 500 bytes in length.
Also see: MG
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
MGTU
Rare
December, 1990
.COM file growth; excessive disk activity; file date/time changes;
"????????COM Path not found." message
Origin:
USSR
Eff Length: 273 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The MGTU Virus was submitted in December, 1990 and came from the USSR.
This virus is a non-resident direct action infector of .COM files,
including COMMAND.COM.
When a program infected with the MGTU Virus is executed, the virus will
search the current drive and directory for uninfected .COM programs.
All uninfected .COM programs will become infected with the virus.
Infected .COM programs will have a file length increase of 273 bytes
with the virus being located at the end of the file. Their date and
time in the disk directory will also have been updated to the system
date and time when infection occurred.
Infected systems will display excessive disk activity each time an
infected program is executed. This activity occurs because the virus
is checking all of the .COM programs in the current directory to
determine if they are already infected, or if they need to be infected.
Infected systems may also experience the following message being
displayed for no apparent reason:
"????????COM Path not found."
MGTU does not do anything besides replicate.
Virus Name: Microbes
Aliases:
V Status:
Common - India
Discovered: June, 1990
Symptoms:
BSR
Origin:
Bombay, India
Eff Length: N/A
Type Code: BR - Floppy and Hard Disk Boot Sector Infector
Detection Method: ViruScan V64+, Pro-Scan 1.4+
Removal Instructions: M-Disk, Pro-Scan 1.4+, or DOS SYS Command
General Comments:
The Microbes virus was isolated in June, 1990 in India. It is a
memory resident boot sector infector of both floppy diskettes and
hard disks.
The Microbes virus becomes memory resident when a system is booted
from a disk infected with the Microbes virus. The system may hang
on this boot, and inserted a diskette to boot from will result in
this new diskette becoming infected. At least on the author's XT
test system, the system could not successfully boot with the
Microbes virus present without powering off the system and rebooting
from a write protected master boot diskette.
Mirror
Rare
October, 1990
.EXE growth; decrease in available free memory; mirror effect
of display on activation
Origin:
Unknown
Eff Length: 927 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: ViruScan V67+, Pro-Scan 2.01+
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Mix2
New
March, 1991
.COM & .EXE growth; system hangs;
Decrease in total system and available free memory
Origin:
Europe
Eff Length: 2,287 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V76+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Mix2 Virus was submitted in March, 1991. Original reports of this
virus were received from Europe. Mix2 is based on the Mix1 virus, and
is a memory resident infector of .COM and .EXE files. It does not
infect COMMAND.COM
When the first program infected with Mix2 is executed, Mix2 will install
itself memory resident at the top of system memory, but below the 640K
DOS boundary. It will mark this area of reserved memory "COMMAND Data"
and will hook interrupt 21. Total system and available free memory, as
indicated by the DOS ChkDsk program, will decrease by 3,040 bytes.
Interrupt 12's return will not be moved.
Once Mix2 is memory resident, it will infect .COM and .EXE programs over
9K in length when they are executed. Infected programs will increase
in length by 2,287 to 2,294 bytes with the virus being located at the
end of the infected file. This virus does not alter the file date and
time in the disk directory.
Some programs which are memory intensive, or which allocate all
available memory will hang when executed with Mix2 memory resident.
It is unknown what Mix2 does besides replicate.
Also see: Mix1
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Monxla
Time Virus
Rare
November, 1990
.COM growth; system hangs and/or reboots; program execution
failures
Origin:
Hungary
Eff Length: 939 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Monxla, or Time, Virus was discovered in November, 1990 in Hungary.
This virus is a memory resident direct action infector of .COM files,
including COMMAND.COM.
When a program infected with the Monxla Virus is executed, the virus
will check the current system time. If the system time's current
seconds is greater than 32/100's of a second, the virus will install
a very small portion of itself memory resident at the top of free
memory but below the 640K DOS boundary. The virus allocates 80 bytes,
and will hook interrupts 20 and F2. The F2 interrupt is later used to
determine if the virus is in memory, thus avoiding multiple memory
allocations. The memory resident portion of the virus is not used to
infect files.
Each time a program infected with the Monxla Virus is executed, the
virus will search for one uninfected .COM file with a length between
3,840 and 64,000 bytes to infect. The current directory is searched
first, and then the directories along the system path. Once an
uninfected .COM file is found that satisfies the length requirement,
the virus will infect it. On other than the 13th day of any month,
the virus will add its viral code to the end of the candidate file,
increasing the file's length by 939 bytes.
On the 13th day of any month, the virus activates. The activation
involves damaging the files that it infects based on the current
seconds in the system time. At the time the virus attempts to infect
another .COM file, the virus will damage the file in one of three
ways. If the current seconds was greater than 60/100's, 4 HLTs followed
by a random interrupt will be placed at the beginning of the file
being infected. Later when the program is executed, it may perform
rather strangely be destructive. It depends on what the random interrupt
was. If the current seconds was greater than 30/100's, but less than
60/100's, two INT 19 calls are placed at the beginning of the file.
Later when the program is executed, it will attempt to perform a warm
reboot preserving the current interrupt vectors. This, however, will
result in a system hang if any interrupt between 00h and 1Ch was
previously hooked. If the current seconds was greater than 00/100's
but less than 30/100's, a INT 20 call is placed at the beginning of
the program being infected, thus resulting in it immediately terminating
when later executed.
Virus Name: Monxla B
Aliases:
Time B
V Status:
Rare
Discovered: January, 1991
Symptoms:
.COM growth; File corruption
Origin:
Hungary
Eff Length: 535 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Monxla B Virus was isolated in January, 1991 in Hungary. This virus
is a non-resident direct action infector of .COM files, including
COMMAND.COM.
When a program infected with Monxla B is executed, the virus will check
the seconds portion of the system time. Depending on the value found,
either one .COM program in the current directory will be infected, or
one .COM program in the current directory will be corrupted.
If the seconds portion of the system time is equal 0 or a multiple of 8,
one .COM program in the current directory, or on the system path, will
be corrupted by the first five characters of the selected .COM program
being changed to the hex string: 004D004F4D, or " M OM" in text.
Corrupted programs will not have a file length increase. Later
execution of these corrupted programs will usually result in the
system being hung, requiring a reboot.
Murphy
Murphy-1, V1277, Stealth Virus
Common - Bulgaria
April, 1990
.COM & .EXE growth, system hangs, speaker noise,
possible bouncing ball effect (see Murphy-2 below)
Origin:
Sofia, Bulgaria
Eff Length: 1,277 Bytes
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, F-Prot 1.12+, NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, NAV, or Delete infected files
General Comments:
The Murphy Virus was isolated in Bulgaria in April, 1990. It is
a memory resident generic .COM & .EXE infector, and will infect
COMMAND.COM.
The first time an infected program is executed on a system, the
virus installs itself memory resident. After it is memory resident,
if a file is executed, or openned for any reason, it is infected by
the Murphy Virus. When the first non-infected program is executed
with the virus in memory, the virus will attempt to infect
COMMAND.COM. The program being executed will also be infected at
that time. Infected programs will increase in length by
1,277 Bytes. Programs which are less than 1,277 Bytes in length
will not be infected.
The Murphy Virus watches the system time. When the system time is
between 10AM and 11AM, the virus will turn on the system speaker
and send a 61h to it. At any other time, the virus will not
attempt to use the system speaker.
The following text message is contained within the Murphy Virus,
giving an idea of when it was written and by whom, though they are
not displayed:
"Hello, I'm Murphy. Nice to meet you friend.
I'm written since Nov/Dec.
Copywrite (c)1989 by Lubo & Ian, Sofia, USM Laboratory."
Systems infected by the Murphy Virus may also experience system
hangs when the virus attempts to infect .EXE files.
Known variant(s) of the Murphy Virus are:
Murphy-2 or V1521 - Similar to the Murphy Virus, its length is 1,521
Bytes. The non-displayed messages in the virus are now:
"It's me - Murphy.
MusicBug
Music Boot, Music Bug
Common
December, 1990
decrease in total system and available free memory; clicking;
music randomly played on system speaker; lost clusters
Origin:
Taiwan
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Partition Table Infector
Detection Method: ViruScan V72+
Removal Instructions: Clean-Up V74+, or see below
General Comments:
The MusicBug Virus is a memory resident boot sector and partition table
infector discovered in December, 1990. It originated in Taiwan.
When a system is booted from a diskette infected with the MusicBug
Virus, the virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary. The interrupt 12 return
will be moved, so 640K systems will now report 638K of installed
system memory. Clicking may be heard for a short time from the system
speaker before the boot proceeds, but more likely a section of a tune
will be played. The boot will then proceed.
Once MusicBug is memory resident, it will periodically play another
portion of the same tune when disk accesses occur. It is thus rather
disruptive.
When MusicBug is memory resident, any disk accessed (including the
system hard disk) will become infected with the virus. In the case
of hard disks, MusicBug infects the hard disk partition table and boot
sector.
Infected disks will have 4K in lost clusters which will contain the
virus's code as well as a copy of the disk's original boot sector.
The following text strings can also be found in these lost clusters:
"MusicBug v1.06. MacroSoft Corp."
"Made in Taiwan"
Diskettes infected with the MusicBug Virus can be disinfected after
powering off the system and booting from a write protected system
diskette, then using the DOS SYS command. The lost clusters can then
be removed by using the ChkDsk command with the /F parameter.
Hard disks, however, cannot be disinfected in the same way. While
the DOS SYS command will remove the virus from the hard disk's boot
sector, and the lost clusters can be recovered, the hard disk will
remain an unbootable non-system disk until a low-level format is
performed.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
New Jerusalem
Rare
October, 1989
TSR; .EXE, .COM, etc. (see below) growth; system slowdown;
deleted files on Friday 13th
Origin:
Holland
Eff Length: 1,813 Bytes (.COM) & 1,808 Bytes (.EXE)
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V45+, F-Prot, Pro-Scan 1.4+
Removal Instructions: Saturday, CleanUp, F-Prot, Pro-Scan 1.4+
General Comments:
New Jerusalem is a variation of the original Jerusalem virus
which has been modified to be undetectable by ViruScan versions
prior to V45 as well as IBM's VIRSCAN product as of October 20,
1989. The virus was first detected when it was uploaded to
several BBSs in Holland beginning on October 14, 1989. It
infects both .EXE and .COM files and activates on any Friday The
13th, deleting infected programs when they are attempted to be
run.
This virus is memory resident, and as with other Jerusalem
viruses, may infect overlay, .SYS, .BIN, and .PIF files.
Also see: Jerusalem, Jerusalem B, Payday, Suriv 3.00
Virus Name: Nina
Aliases:
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM growth; decrease in total system and available free memory;
Origin:
Bulgaria
Eff Length: 256 Bytes
Type Code: PRhCK - Parasitic Resident .COM & Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Nina Virus was received in December, 1990, and is from Bulgaria.
This virus is a memory resident infector of .COM files, including
COMMAND.COM.
When the first program infected with the Nina Virus is executed, Nina
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system memory and available free
memory will decrease by 1,024 bytes as shown by the DOS ChkDsk command.
Interrupt 21 will be hooked by the virus.
After Nina is memory resident, it will infect .COM programs that are
greater than 256 bytes in length as they are executed. If COMMAND.COM
is executed, it will become infected. Infected .COM programs increase
in length by 256 bytes, and will have the virus located at the beginning
of the infected file.
The Nina Virus is named Nina because the virus contains the text
string "Nina" within the viral code.
Nomenklatura
Nomenclature, 1024-B
Rare
August, 1990
.EXE, .COM growth; decrease in available free memory;
"sector not found" messages on diskettes;
Origin:
Netherlands
Eff Length: 1,024 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V67+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D or Delete infected files
General Comments:
The Nomenklatura Virus was isolated in August, 1990 in the
Netherlands. This virus is a memory resident infector of .COM and
.EXE files, including COMMAND.COM. It is not related to the V1024
virus, though it is the same length.
The first time a program infected with the Nomenklatura Virus is
executed on a system, the virus installs itself memory resident at
the top of available system memory, but below the 640K DOS boundary.
Available system memory will decrease by 1,024 bytes, and interrupt
21 will be hooked by the virus.
When the virus is memory resident, any .COM or .EXE program greater in
length then approximately 1,023 bytes that is executed or openned
for any reason will be infected by the Nomenklatura virus. Infected
files will have their file lengths increased by 1,024 bytes. The
virus does not hide the increase in file length when the disk directory
is displayed.
Attempts to execute uninfected programs from a write-protected diskette
with the virus in memory will result in a "Sector not found error"
message being displayed, and the program not being executed.
The Nomenklatura Virus is destructive to the contents of diskettes
exposed to infected systems. File corruption will randomly occur,
with the frequency increasing as the disk becomes more filled with data.
The file errors may occur on data files as well program files. This
file corruption occurs due to the virus occassionally swapping a pair of
words in the sector buffer. It may also do this to critical system
areas such as the FAT, boot sector, or directories since it may occur
to any clusters on the disk. If a file or critical system area was
residing in a corrupted cluster, it will be corrupted. As such, systems
which has been exposed to the Nomenklatura Virus must be carefully
checked as the integrity of non-infected programs and any datafiles
should be considered suspect.
The virus has been named Nomenklatura as this text string appears in
all programs infected with this virus.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Origin:
Number One
Number 1
Extinct
1987 (see below)
.COM files fail to function; <Smile> displayed
West Germany
"V I R U S
b y
The Hackers
Y C 1 E R P
D E N Z U K 0
Bandung 40254
Indonesia
(C) 1988, The Hackers Team...."
Also see: Den Zuk
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Ontario
Rare
July, 1990
.COM & .EXE growth; decrease in system and free memory;
hard disk errors in the case of extreme infections
Origin:
Ontario, Canada
Eff Length: 512 Bytes
Type Code: PRtAK - Parasitic Encrypted Resident .COM & .EXE Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+, NAV
Removal Instructions: SCAN /D, or Delete infected files
General Comments:
The Ontario Virus was isolated by Mike Shields in Ontario, Canada
in July, 1990. The Ontario virus is a memory resident infector of
.COM, .EXE, and overlay files. It will infect COMMAND.COM.
The first time a program infected with the Ontario Virus is executed,
it will install itself memory resident above the top of system memory
but below the 640K DOS boundary. Total system memory and free memory
will be decreased by 2,048 bytes. At this time, the virus will
infect COMMAND.COM on the C: drive, increasing its length by 512 bytes.
Each time an uninfected program is executed on the system with the
virus memory resident, the program will become infected with the viral
code located at the end of the file. For .COM files, they will
increase by 512 bytes in all cases. For .EXE and overlay files, the
file length increase will be 512 - 1023 bytes. The difference in
length for .EXE and overlay files is because the virus will fill out
the unused space at the end of the last sector of the uninfected file
with random data (usually a portion of the directory) and then append
itself to the end of the file at the next sector. Systems using
a sector size of more than 512 bytes may notice larger file increases
for infected files. Infected files will always have a file length
that is a multiple of the sector size on the disk.
In the case of extreme infections of the Ontario Virus, hard disk
errors may be noticed.
Ontario uses a complex encryption routine, and a simple identification
string will not identify this virus.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Oropax
Music Virus, Musician
Rare
December, 1989
.COM growth, tunes
Origin:
Eff Length: 2,756 - 2,806 bytes, but usually 2,773 bytes
Type Code: PRC - Parasitic Resident .COM Infector
Detection Method: ViruScan V53+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: SCAN /D, F-Prot, VirexPC, Pro-Scan 1.4+, VirHunt 2.0+
or delete infected files
General Comments:
The Oropax virus has had several reports, but wasn't first isolated
until December 1989. It infects .COM files, increasing their length
by between 2,756 bytes and 2,806 bytes. Infected files will always
have a length divisible by 51. The virus may become active (on a
random basis) five minutes after infection of a file, playing three
different tunes with a seven minute interval in between.
One variant recently reported in Europe plays six different
tunes at seven minute intervals.
Virus Name:
Aliases:
V Status:
Discovery:
Symptoms:
Paris
Rare
August, 1990
.COM & .EXE file growth; slow program loads upon execution;
Diskette corruption after diskette boot
Origin:
Paris, France
Eff Length: 4,909 Bytes
Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Paris Virus was isolated in Paris, France, in early August, 1990.
This virus is a generic infector of .COM, .EXE and overlay files,
and will infect COMMAND.COM. It is not memory resident.
When a program infected with the Paris Virus is executed, the virus
will infect all .COM, .EXE and overlay files on the current drive
and directory, with the exception of very small .COM files. It will
also check to see if COMMAND.COM on the C: drive is uninfected, if it
has not previously been infected it will become infected. Infected
files will increase in length by between 4,909 - 4, 25 bytes, with the
virus located at the end of the infected file.
The Paris Virus can be destructive in some instances, resulting in
diskettes becoming corrupted if the system is booted from a diskette
with a Paris infected COMMAND.COM program.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Parity
Rare
December, 1990
.COM file growth; long .COM program loads;
possibly intermittent parity errors
Origin:
Bulgaria
Eff Length: 441 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
Payday
Rare
November, 1989
TSR, .EXE & .COM growth, system slowdown, deleted files
on Friday EXCEPT 13th, "Black WIndow"
Origin:
Netherlands
Eff Length: 1,808 Bytes (.EXE) & 1,813 Bytes (.COM)
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V51+, F-Prot, Pro-Scan 1.4+, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: UnVirus, Saturday, CleanUp, F-Prot, Pro-Scan 1.4+,
NAV
General Comments:
The Payday virus was isolated by Jan Terpstra of the Netherlands
in November, 1989. It is a variant of the Jerusalem B virus,
the major difference being that the activation criteria to
delete files has been changed from every Friday The 13th to
any Friday but Friday The 13ths.
Also see: Jerusalem, Jerusalem B, New Jerusalem, Suriv 3.00
Virus Name: Pentagon
Aliases:
V Status:
Extinct
Discovered: January, 1988
Symptoms:
TSR, BSC 360k floppies, file (see text)
Origin:
USA
Eff Length: N/A
Type Code: RF - Resident Floppy Boot Sector Infector
Detection Method: ViruScan, F-Prot, VirexPC
Removal Instructions: MDisk, CleanUp, or DOS SYS Command
General Comments:
The Pentagon virus consists of a normal MS-DOS 3.20 boot
sector where the name 'IBM' has been replaced by 'HAL', along
with two files. The first file has a name of the hex
character 0F9H, and contains the portion of the virus code
which would not fit into the boot sector, as well as the
Phantom
Rare
January, 1991
.COM growth; Message; Shift of System Display;
Decrease in total system and available memory
Origin:
Hungary
Eff Length: 2,274 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: ViruScan V75+
Removal Instructions: Scan/D, or delete infected files
General Comments:
The Phantom Virus was isolated in Hungary in January, 1991, by Dr.
Szegedi Imre. This virus is a memory resident infector of .COM files,
but not COMMAND.COM.
The first time a program infected with the Phantom Virus is executed,
the Phantom Virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary. Infected systems will
have interrupts 20 and 21 hooked by the virus, and the DOS ChkDsk
program will report total system and available memory as 2,704 bytes
less than expected.
After becoming memory resident, the Phantom Virus will infect .COM
programs as they are executed or openned if the original file length
is greater than 2K. Infected programs will increase in size by 2,274
bytes with the virus being located at the end of infected programs.
Systems infected with the Phantom Virus will experience the following
message being displayed intermittently when programs are executed:
"HI ROOKIE!
I`m a THESEASE! I live in YOUR computer - sorry...
Thanks to Brains in the Computer Siences!"
This message, as with the following text strings which also occur in
the virus's code, cannot be seen in infected programs as they are
encrypted. The other text strings which are encrypted in the viral
code are:
"The PHANTOM Was HERE - SORRY"
"(c) PHANTOM - This virus was designed in the HUNGARIAN
VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0"
Another symptom of the Phantom Virus is that it will occasionally
alter the system display so that what should start on the left side of
the screen starts in the middle (it is shifted 50% with wrap around on
the same line).
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Phoenix
P1
Rare
July, 1990
.COM growth, system reboots, CHKDSK program failure,
COMMAND.COM header change
Origin:
Bulgaria
Eff Length: 1,704 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, or delete infected files
General Comments:
The Phoenix virus is of Bulgarian origin, and was submitted to
the author of this document in July, 1990 by Vesselin Bontchev.
This virus is one of a family of three (3) viruses which may be
referred to as the P1 or Phoenix Family. Each of these viruses is
being documented separately due to their varying characteristics.
The Phoenix virus is a memory resident, generic infector of .COM
files, and will infect COMMAND.COM.
The first time a program infected with the Phoenix virus is executed,
the virus will install itself memory resident in free high memory,
reserving 8,192 bytes. Interrupt 2A will be hooked by the virus.
System total memory and free memory will decrease by 8,192 bytes.
If the program was executed from a floppy drive, and COMMAND.COM was
not present on the diskette, the virus will request that a diskette
with \COMMAND.COM present be inserted in the drive. Phoenix will
immediately infect COMMAND.COM by overwriting part of the binary zero
portion of the program, and changing the program's header information.
COMMAND.COM will not change in file length. The virus will then
similarly infect COMMAND.COM residing in the C: drive root directory.
After becoming memory resident, the virus will attempt to infect any
.COM file executed. Most of its attempts, however, will not result in
a file being infected. Phoenix is a fairly poor replicator. If the
virus is successful in infecting the file, it will append its viral
code to the end of the file, increasing the file's length by 1,704
bytes.
Phoenix is not able to recognize when it has previously infected a file,
so it may reinfect .COM files several times. Each infection will
result in another 1,704 bytes of viral code being appended to the
file.
Systems infected with the Phoenix virus will experience problems with
executing CHKDSK.COM. Attempts to execute this program with Phoenix
memory resident will result in a warm reboot of the system occurring,
however the memory resident version of Phoenix will not survive the
reboot. If an autoexec.bat file is not present on the drive being
booted from, the system will prompt for the user to enter Date and
Time.
The Phoenix Virus employs a complex encryption mechanism, and virus
scanners which are only able to look for simple hex strings will not
be able to detect it. There is no simple hex string in this virus
that is common to all infected samples.
This virus is not related to the Cascade (1701/1704) Virus.
Also see: Evil, PhoenixD
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
PhoenixD
P1
Rare
July, 1990
.COM growth, system reboots, CHKDSK program failure,
COMMAND.COM header change
Origin:
Bulgaria
Eff Length: 1,704 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, or delete infected files
General Comments:
The PhoenixD virus is of Bulgarian origin, and was submitted to
the author of this document in July, 1990 by Vesselin Bontchev.
This virus is one of a family of three (3) viruses which may be
referred to as the P1 or Phoenix Family. Each of these viruses is
being documented separately due to their varying characteristics.
The PhoenixD virus is a memory resident, generic infector of .COM
files, and will infect COMMAND.COM.
The PhoenixD Virus is a "bug fixed" version of the Phoenix virus.
The first time a program infected with the PhoenixD virus is executed,
the virus will install itself memory resident in free high memory,
reserving 8,192 bytes. Interrupt 2A will be hooked by the virus.
System total memory and free memory will decrease by 8,192 bytes.
PhoenixD will then check to see if the current drive's root directory
The Ping Pong Virus is extinct, though the hard disk variant,
Ping Pong-B listed below, is one of the most common MS-DOS
viruses.
Virus Name: Ping Pong-B
Aliases:
Bouncing Ball Boot, Italian-A
V Status:
Common
Discovered: May, 1988
Symptoms:
Graphic display (see text), TSR, BSC
Origin:
Eff Length: N/A
Type Code: BRs - Resident Boot Sector Infector
Detection Method: ViruScan, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: CleanUp, MDisk, Pro-Scan 1.4+, F-Prot, VirexPC, NAV,
or DOS SYS Command
General Comments:
The Ping Pong-B virus is a variant of the Ping Pong virus. The
major difference is that Ping Pong-B can infect hard disks as
well as floppies.
Known variants of Ping Pong-B include:
Ping Pong-C : Similar to Ping Pong-B, though this variant does
not have the bouncing ball screen effect.
Origin: Argentina, June 1990.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Plastique
Plastic Bomb, Plastique 3012, Plastique 1
Rare
July, 1990
TSR; .COM & .EXE growth; possible system slowdown or bomb
noises after September 20
Origin:
Taiwan
Eff Length: 3,012 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+
Removal Instructions: Clean-Up V72+, Pro-Scan 2.01+, or Delete infected files
General Comments:
The Plastique, or Plastic Bomb, Virus was submitted in July 1990, it
comes to us from Taiwan. Plastique is a memory resident generic
infector of .COM and .EXE files, though it does not infect
COMMAND.COM. Unlike the Plastique-B Virus listed below, this virus
does not infect floppy disk boot sectors.
The first time a program infected with Plastique is executed, the
virus will install itself memory resident as a TSR in low system
memory. The TSR is 3,264 bytes in length, and hooks interrupt 21.
After the virus is memory resident, it will attempt to infect any
.COM or .EXE file which is executed. This virus is rather "buggy",
and it is not always successful in infecting files when they are
executed. When it is successful infecting the file, the file's
length will increase. For infected .COM files, the length will
increase by 3,012 bytes. For infected .EXE files, their length
will increase between 3,012 and 3,020 bytes.
Plastique will also attempt to infect files when they are opened for
If the system date is after September 20th, the virus will install
itself memory resident in high system memory but below the 640K DOS
boundary. The same interrupts will be hooked by the virus.
After the virus is memory resident, it will attempt to infect any
.COM or .EXE file which is executed or opened for any reason. It
has had many of the "bugs" fixed that were in Plastique, and is
usually successful in infecting files. Infected .COM and .EXE files
will increase in length by 4,096 bytes.
Plastique-B will also infect the boot sector of any diskettes accessed
on an infected system.
After September 20th, 1990, the Plastique-B virus activates. It
will either progressively slowdown the system or cause "bomb" noises
to be emitted periodically from the system speaker. It may also
overwrite the contents of all drives after this date, depending on if
a predetermined limit in the virus has been reached.
Also see: Plastique, Invader
Virus Name: Polimer
Aliases:
Polimer Tapeworm
V Status:
Rare
Discovered: November, 1990
Symptoms:
.COM growth; Message
Origin:
Hungary
Eff Length: 512 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V71+, Pro-Scan 2.01+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Polimer Virus was discovered in Hungary in November, 1990. This
virus is a non-resident infector of .COM files, including COMMAND.COM.
When a program infected with the Polimer Virus is executed, the
following message will be displayed:
"A le' jobb kazetta a POLIMER kazetta !
This message can be found near the beginning of all infected files.
After the message is displayed, the virus will attempt to infect one
.COM file on the current drive and directory, and one .COM file on the
C: drive's current directory. This virus will only infect .COM files
which are between 512 and 64,758 bytes in length. If the .COM file it
attempts to infect has the Read-Only attribute, it will not be infected,
and the message $ERROR will be displayed.
Although this virus is actually 456 bytes in length, infected .COM files
will increase in size by 512 bytes with the virus's code being located
at the beginning of the file.
This virus does not appear to do anything besides replicating.
Virus Name:
Aliases:
V Status:
Discovered:
Polish 217
217, Polish Stupid
Rare
October, 1990
Symptoms:
.COM growth; system reboot
Origin:
Koszalin, Poland
Eff Length: 217 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Polish 217, or Polish Stupid, Virus was discovered in Koszalin,
Poland, in October, 1990. This virus is a non-resident infector of
.COM files, including COMMAND.COM.
When a program infected with the Polish Stupid Virus is executed, the
virus will infect the first uninfected .COM file found in the current
directory. Infected .COM files will increase in length by 217 bytes
with the virus's code being located at the end of the file. Infected
files will also end with the hex string 5757h. The file's date and
time in the disk directory is not altered.
A side note on this virus: when the copy of COMMAND.COM pointed to by
the COMSPEC environmental variable is infected by the virus, the system
will experience a warm reboot.
This virus does nothing besides replicating in its current version.
Known variant(s) of Polish 217 are:
Polish 217 B : The Polish 217 B variant's major difference is that
when COMMAND.COM is infected, a warm reboot does not occur.
Execution of COMMAND.COM will result in the error message:
"Specified COMMAND search directory bad". Execution of
infected programs may also result in the following message
being displayed and the program terminated:
"????????COM
Path not found."
Programs which can detect Polish 217 may not be able to detect
Polish 217 B as it has been altered. Scan V72 and below will
not detect it.
Virus Name: Polish 529
Aliases:
529
V Status:
Rare
Discovered: September, 1990
Symptoms:
.COM growth; TSR
Origin:
Poland
Eff Length: 529 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Polish 529 Virus was isolated in September, 1990 in Poland. This
virus is a memory resident infector of .COM files. It will infect
COMMAND.COM if it is executed with the virus in memory.
The first time a program infected with the Polish 529 Virus is executed,
the virus will install itself memory resident as a low system memory
TSR of 1,664 bytes. Interrupt 21 will be hooked by the virus.
Once the virus is memory resident, any .COM file over approximately
1600 bytes in length will be infected by the virus. Infected .COM
files will show a file length increase of 529 bytes and have the
Proud
V1302, P1 Related
Rare
August, 1990
.COM growth; decrease in total system and available memory;
FAT entry corruption
Origin:
Bulgaria
Eff Length: 1,302 Bytes
Type Code: PRtCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Proud, or V1302, Virus was isolated in August of 1990 in Bulgaria
by Vesselin Bontchev. Proud is a memory resident infector of .COM
files, including COMMAND.COM.
The first time a program infected with Proud is executed, the virus
checks to determine if interrupt 13 is in use by another program, and
if it is, the virus will hang the system. If interrupt 13 is not in
use by another program, Proud will install itself memory resident at
the top of system memory, but below the 640K DOS boundary. Total
system memory and free available memory will decrease by 8,192 bytes.
Interrupt 2A will be replaced by the virus.
Once the virus is memory resident, it will infect .COM files within
certain candidate length ranges whend they are openned for any reason.
The candidate file length ranges are:
2,048
16,384
32,768
49,152
14,335
30,719
47,103
63,487
bytes
bytes
bytes
bytes
A C H T U N G
--------------------------Die Benutzung einer RAUBKOPIE ist strafbar!
Nur wer Original-Disketten, Handbucher,
oder PD-Lizenzen besitzt, darf Kopien verwenden.
Programmierung is muhevolle Detailarbeit:
Wer Raubkopien verwendet, betrugt
Programmierer un den Lohn ihrer Arbeit.
---------------------------
"
A pause will then occur, and the following question will be displayed:
"Bist Du sauber ? (J/N) "
Entering "J" for yes will result in the following message being
displayed and the program which the user was attempting to execute
will proceed to execute:
"Ich will glauben, was Du sagst ..... "
Entering "N" for no will result in the following messages, the second
of which is garbled, and the program the user was attempting to execute
will be terminated:
"CPU-ID wird gespeichert...
**** LO<garbled>
"
Red Diavolyata
USSR 830
Rare
December, 1990
.COM growth; decrease in system and available memory;
file date/time changes
Origin:
USSR
Eff Length: 830 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Red Diavolyata Virus is an 830 byte memory resident infector of
.COM files, including COMMAND.COM. It was submitted in December, 1990,
and originated in the USSR.
The first time a program infected with Red Diavolyata is executed, the
virus will install itself memory resident at the top of system memory
but below the 640K DOS boundary. The interrupt 12 return is not moved.
The DOS ChkDsk command will indicate that total system memory and
available free memory have decreased by 960 bytes. Interrupt 21 will
be hooked by the virus.
Once Red Diavolyata is memory resident, any .COM program executed will
become infected by the virus. If COMMAND.COM is executed, it will be
infected.
Infected .COM programs will have their file length increased by 830
bytes, and their date and time in the disk directory will have been
altered to the system date and time when infection occurred. The virus
Symptoms:
infector of .COM and .EXE files, and does not infect COMMAND.COM.
The first time a program infected with the Scott's Valley Virus is
executed, the virus installs itself memory resident as a low system
memory TSR of 2,384 bytes. Interrupt 21 is hooked by the virus.
After the virus is memory resident, any .COM or .EXE file executed
will be infected with the virus. .COM files will increase in length
by 2,131 bytes. .EXE files will increase in length between 2,131
and 2,140 bytes.
Infected programs will contain the following hex string in the virus's
code: 5E8BDE909081C63200B912082E.
It is unknown if this virus is malicious.
Virus Name: Sentinel
Aliases:
V Status:
Rare
Discovered: January, 1991
Symptoms:
.COM & .EXE growth; decrease in available free memory
Origin:
Bulgaria
Eff Length: 4,625 Bytes
Type Code: PRHAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Sentinel Virus was submitted in January, 1991, and is from
Bulgaria. This virus is a memory resident infector of .COM and .EXE
files, and will infect COMMAND.COM. Unlike most viruses, this virus
was received with its original Turbo Pascal source code. It may be
purely a research virus at this time.
When the first program infected with Sentinel is executed, the virus
will install itself memory resident at the top of system memory, but
below the 640K DOS boundary. Interrupt 12's return is not moved by
the virus. Interrupt 21 will be hooked by the virus in memory.
COMMAND.COM, if not previously infected, will be infected by Sentinel
at this time as well.
After Sentinel is memory resident, it will infect .COM and .EXE
programs larger than 1K as they are openned or executed. Infected
programs will have a file length increase of 4,625 bytes, the virus
will be located at the end of the file. This virus makes no attempt
to hide the file length increase. File date and time in the disk
directory is not altered by the virus.
The following text strings can be found at the very end of programs
infected with Sentinel:
"You won't hear me, but you'll feel me....
(c) 1990 by Sentinel.
With thanks to Borland."
Sentinel does not appear to do anything besides replicate.
Virus Name: SF Virus
Aliases:
V Status:
Extinct
Discovered: December, 1987
Symptoms:
BSC 360k floppies, Resident TOM, formatted disks
Origin:
California, USA
Eff Length: N/A
Type Code: RtF - Resident Floppy Boot Sector Infector
Detection Method: ViruScan (identifies as Alameda)
Removal Instructions: MDisk, CleanUp, F-Prot, or DOS SYS command
General Comments:
The SF Virus is a modified version of the Alameda virus
which activates when the counter in the virus has determined
that it is infected 100 diskettes. The virus replicates when
a CTL-ALT-DEL is performed, infecting the disk in the floppy
drive. Upon activation, the diskette in the floppy drive is
reformatted. The SF Virus only infects 5 1/4" 360K floppies.
Also see: Alameda
Virus Name: Shake Virus
Aliases:
V Status:
Rare
Discovered: May, 1990
Symptoms:
.COM growth, message, change in COMMAND.COM memory allocation
Origin:
Bulgaria
Eff Length: 476 Bytes
Type Code: PRCK - Resident Parasitic .COM Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, VirexPC, F-Prot 1.12+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D, Pro-Scan 2.01+, or Delete Infected Files
General Comments:
The Shake Virus was first isolated in Bulgaria in May, 1990 by
Daniel Kalchev. It is a memory resident generic .COM infector, and
will infect COMMAND.COM.
The first time an infected program is executed, the Shake Virus will
install itself memory resident, altering the image of COMMAND.COM in
memory.
The Shake Virus infects .COM files, infecting them as they are
accessed. Infected files increase in size by 476 Bytes, though the
size increase cannot be seen using a DIR (list directory) command
if the virus is memory resident.
While the virus is not destructive, it will occasionally
display the message: "Shake well before use !" when an infected
file is attempted to be run. When this message is displayed, the
program terminates rather than executes. A second attempt to run
the same program result in it running successfully.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Slayer Family
Brain Slayer, Slayer, Yankee Doodle Dropper
New
March, 1991
.COM & .EXE growth; Long disk accesses; Disk directory altered;
Disk accesses to unexpected drives
Origin:
USA
Eff Length: 5,120 Bytes
Type Code: PNA - Resident Non-Parasitic .COM & .EXE Infector
The first time a program infected with the Sorry Virus is executed,
the virus will install itself memory resident in high memory. Total
system memory and free memory will both decrease by 1,024 bytes.
Interrupt 21 will be hooked by the virus. COMMAND.COM is immediately
infected by the virus, thus insuring on later system boots that the
virus becomes memory resident immediately.
After the virus is memory resident, it will infect any .COM file
which is executed, increasing the file's length by 731 bytes. The
viral code is located at the end of infected files.
The Sorry Virus contains the following text strings:
"G-VIRUS V1.3"
"Bitte gebe den G-Virus Code ein"
"Tut mir Leid !"
It is unknown what the Sorry Virus does when it activates.
Also see: Perfume
Virus Name: Sparse
Aliases:
V Status:
New
Discovered: April, 1991
Symptoms:
TSR; .COM growth
Origin:
Unknown
Eff Length: 3,840 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Sparse Virus was received in April, 1991. Sparse is a memory
resident infector of .COM files, including COMMAND.COM.
The first time a program infected with Sparse is executed, the virus
will install itself memory resident as a low system memory TSR of
3,872 bytes. Interrupts 21, D1 and D3 will be hooked by the virus.
Once Sparse is memory resident, it will infect .COM programs, including
COMMAND.COM, when they are executed. Infected .COM programs will
increase in size by 3,840 bytes with the virus being located at the
beginning of the infected file. The infected file's date and time in
the disk directory will also be updated to the system date and time
when infection occurred.
Programs infected with Sparse will have the ASCII characters "UK" as
the second and third bytes of the executable program. They will also
contain the text string SHELLC, and contain the name of the program
that originally resulted in the virus becoming memory resident. (If
the first infected program executed was "sparse.com", then "sparse.com"
will be found in all later infected programs as long as the virus was
memory resident.)
It is not known if Sparse does anything besides replicate.
Virus Name: Spyer
Aliases:
V Status:
Rare
Discovered: November, 1990
Symptoms:
TSR; .COM & .EXE growth; system hangs
Origin:
Taiwan
Eff Length: 1,181 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D or Delete infected files
General Comments:
The Spyer Virus was isolated in November, 1990 in Taiwan. This virus
is a memory resident infector of .COM and .EXE files. It does not
infect COMMAND.COM.
The first time a program infected with the Spyer Virus is executed,
the Spyer Virus will install itself memory resident as a 1,760 byte
low system memory TSR. Interrupts 21 and 22 will be hooked by the
virus.
Once the virus is memory resident, the virus will attempt to infect
the next program that is executed. If the program is already infected
with the Spyer Virus, the system will become hung. If the program was
not already infected, Spyer will infect it and then hang the system.
Infected .COM files will always increase in length by 1,181 bytes.
.EXE files infected with Spyer will have a file length increase between
1,181 and 1,195 bytes. In both cases, the virus will be located at
the end of the infected file. Infected files will also always have the
following hex character sequence at the end of file: "CBDFD9DE848484".
The Spyer Virus, in its present form, is not expected to ever be a
serious problem. Since it always hangs the system when the next program
is executed after becoming memory resident, it is simply too obvious
that something is wrong.
Virus Name: Staf
Aliases:
Staff
V Status:
New
Discovered: April, 1991
Symptoms:
.COM growth; Messages; Programs may fail to execute
Origin:
Unknown
Eff Length: 2,083 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V76+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Staf Virus was received in April, 1991. Its origin is unknown, but
first reports of it were out of Europe. This virus is a non-resident
direct action .COM file infector. It will infect COMMAND.COM.
When a program infected with the Staf Virus is executed, the virus will
display the following message:
"This program has been infected by:
Virus Demo Ver.: 1.1 - Handle with care!
By STAF (Tel.: (819) 595-0787)
Generation #n
Infecting: xxxxxxxx.COM
The StarDot 801 Virus was submitted in April, 1991. Its origin is
unknown, though it is very similar to the Italian 803 virus, so it
may also be from Italy. StarDot 801 is a non-resident, direct action
infector of .COM and .EXE programs. It will infect COMMAND.COM.
When a program infected with StarDot 801 is executed, the virus will
look for an uninfected .EXE program in the current directory to infect.
If an uninfected .EXE program does not exist in the current directory,
it will then look for an uninfected .COM program to infect. Once an
uninfected program is selected, the virus will infect it, adding the
viral code to the end of the program.
Programs infected with StarDot 801 will increase in size by 804 to
817 bytes. Their date and time in the disk directory will not be
altered.
StarDot 801 does not appear to do anything besides replicate. System
hangs, however, may occur when some infected programs are executed.
Virus Name: Stone`90
Aliases:
Polish 961, Stone-90
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM file growth
Origin:
Poland
Eff Length: 961 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Stone`90 Virus, or Polish 961, is a non-resident direct action
infector of .COM programs, including COMMAND.COM. It was submitted
in December, 1990, and is from Poland.
When a program infected with the Stone`90 Virus is executed, the virus
will look for one .COM program on the current drive and in the current
directory to infect. If one is found, the virus will infected it.
The newly infected .COM program will increase in length by 961 bytes,
and have the virus's code located at the end of the program.
The following text strings can be found in infected files:
"Sorry, I`m INFECTED!"
"I`m already NOT infected!"
"(C) Stone`90"
Stone`90 does not appear to do anything besides replicate.
Virus Name: Stoned
Aliases:
Donald Duck, Hawaii, Marijuana, New Zealand, Rostov, San Diego,
Sex Revolution, Smithsonian, Stoned II
V Status:
Common
Discovered: February, 1988
Symptoms:
BSC, TSR, messages, RLL controller hangs
Origin:
New Zealand
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Partition Table Infector
Detection Method: ViruScan, CleanUp, F-Prot, IBM Scan, Pro-Scan, VirexPC,
Stoned-A : Same as Stoned above, but does not infect the system hard
disk. This is the original virus and is now extinct. The
text found in the boot sector of infected diskettes is:
"Your computer is now stoned. Legalize Marijuana".
The "Legalize Marijuana" portion of the text is not
displayed.
Stoned-B : Same as Stoned indicated above. Systems with RLL controllers
may experience frequent system hangs. Text typically found
in this variant is:
"Your computer is now stoned. Legalise Marijuana".
The "Legalise Marijuana" may also be in capital letters, or
may be partially overwritten. It is not displayed.
Stoned-C : same as Stoned, except that the message has been
removed.
Stoned-D : same as Stoned, with the exception that this variant
can infect high density 3.5" and 5.25" diskettes.
Stoned II: Based on Stoned-B, this variant has been modified to
avoid detection by anti-viral utilities. Since its
isolation in June, 1990, most utilities can now detect
this variant. Text in the virus has been changed to:
"Your PC is now Stoned! Version 2"
Or:
"Donald Duck is a lie."
The "Version 2" portion of the text may be corrupted as well.
Rostov
General Comments:
The Striker #1 Virus was isolated in the Eastern United States in
March, 1991. This virus is a non-resident, direct action infector of
.COM programs, including COMMAND.COM.
When a program infected with Striker #1 is executed, the virus will
infect one .COM program. Infected .COM programs will have the first
thirteen bytes altered, and then the body of the virus appended to the
end of the program. Infected programs will show a file length increase
of 461 bytes in the disk directory, file date and times are not altered.
Infected programs can be easily identified as the text string
"Striker #1" will appear in the fourth thru thirteenth bytes of all
infected programs. This string also appears near the end of infected
programs.
Striker #1 does not appear to do anything besides replicate.
Virus Name: Subliminal 1.10
Aliases:
V Status:
Rare
Discovered: May, 1990
Symptoms:
.COM growth, TSR, unusual file errors, video display flicker
Origin:
California, USA
Eff Length: 1,496 Bytes
Type Code: PRsC - Resident Parasitic .COM Infector
Detection Method: ViruScan V64+, Pro-Scan 1.4+, NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, or Delete Infected Files
General Comments:
The Subliminal 1.10 Virus was first isolated in Solano County,
California in May 1990 by Jay Parangalan. The name of the
virus can be produced by negating (XORing with FF) some null
terminated bytes in the viral code. Using this technique, the
creation date of the virus appears to be 02OCT89. The
Subliminal 1.10 Virus appears to be a very early version of the
Solano 2000 Virus, and has only been reported at Solano
Community College.
The first time a program infected with the Subliminal 1.10 Virus
is executed, the virus installs itself memory resident. Any
.COM files which are then executed are infected. Infected
programs will increase in length by 1,496 bytes.
With the virus memory resident, the system monitor will appear to
flicker. What is occurring is that the virus is attempting to
flash the message "LOVE, REMEMBER?" in the lower left portion of
the display for a subliminal duration. The actual amount of time
the message displays on the screen varies between systems due to
CPU speed.
Also see: Solano 2000
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Origin:
Sunday
Common
November, 1989
TSR, executable file growth, messages, FAT corruption
Washington (state), USA
Aliases:
April 1st-B, Israeli, Suriv02
V Status:
Extinct
Discovered: 1987
Symptoms:
TSR, .EXE growth, messages, system lock April 1st
Origin:
Israel
Eff Length: 1,488 bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, VirexPC, Pro-Scan,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: Scan/D/X, F-Prot, UnVirus, VirHunt 2.0+
General Comments:
The Suriv 2.01 virus is a memory resident .EXE infector. It
will activate on April 1st after memory is infected by running
an infected file, displaying the same message as Suriv 1.01
and locking up the system. The virus will cause a similar
lockup, though no message, 1 hour after an infected .EXE file
is executed on any day on which the system default date of
01-01-80 is used. The virus will only infect the file once.
Virus Name: Suriv 3.00
Aliases:
Israeli, Suriv03
V Status:
Extinct
Discovered: 1988
Symptoms:
TSR, .COM, .EXE, & .SYS growth; Black Window; system slowdown
Origin:
Israel
Eff Length: 1,813 (COM files) & 1,808 (EXE files) bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan/X V67+, F-Prot, Pro-Scan, VirexPC, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: CleanUp, Scan/D/X, F-Prot, Unvirus, VirHunt 2.0+
General Comments:
May be a variant of the Jerusalem virus. The string "sUMsDos"
has been changed to "sURIV 3.00". The Suriv 3.00 virus
activates on Friday The 13ths when an infected program is
run or if it is already present in system memory, however
files are not deleted due to a bug in the viral code.
Other than on Friday The 13ths, after the virus is memory
resident for 30 seconds, an area of the screen is turned into
a "black window" and a time wasting loop is executed with
each timer interrupt.
As with the Jerusalem B viruses, this virus can also infect
overlay, .SYS, and other executable files besides .EXE and
.COM files, though it does not infect COMMAND.COM itself.
Also see: Jerusalem, Jerusalem B
Virus Name: Sverdlov
Aliases:
Hymn-2
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM & .EXE growth; decrease in total system and available memory
Origin:
USSR
Eff Length: 1,962 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected programs
General Comments:
The Sverdlov Virus was submitted in December, 1990. This virus is
believed to have originated in the USSR. Sverdlov is a memory resident
infector of .COM and .EXE files, and will infect COMMAND.COM. This
virus is also encrypted.
The first time a program infected with the Sverdlov Virus is executed,
the virus will install itself memory resident at the top of system
memory but below the DOS 640K boundary. 4,080 bytes of memory will
have been reserved, and the interrupt 12 return is not altered by the
virus. The DOS ChkDsk program will indicate that total system memory
and available free memory is 4,080 bytes less than expected.
COMMAND.COM will also be infected at this time if it was not already
infected.
Once Sverdlov is memory resident, any .COM or .EXE file over 2K in
length will become infected if it is executed or openned for any reason.
Infected .COM files have a file length increase of 1,962 bytes.
Infected .EXE files will have a file length increase of 1,962 to
1,977 bytes in length. In both cases, the virus will be located at the
end of infected programs.
It is unknown if Sverdlov does anything besides replicate.
Known variant(s) of Sverdlov include:
Sverdlov-B : Very similar to the original Sverdlov Virus, this variant
has one basic change in behavior. It will only infect
.COM and .EXE files over 3K in length before infection.
Otherwise, the virus code is very similar. This variant
may have been altered to avoid detection, and some
anti-viral programs may identify it as Hymn-2.
Virus Name: SVir
Aliases:
V Status:
Endangered
Discovered: 1990
Symptoms:
.EXE growth; file date/time changes; system hangs
Origin:
Poland
Eff Length: 512 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan V76+, NAV
Removal Instructions: Scan/D, or Delete infected programs
General Comments:
The SVir Virus was originally isolated in Poland early in 1990. The
original virus which was isolated had a fatal flaw in its code which
prevented it from executing. In August, 1990, a sample was obtained
from Fridrik Skulason which now does replicate. This second sample,
identified as SVir-B, is a non-resident infector of .EXE files. A
third variant was received in April, 1991.
Each time a program infected with the SVir-B Virus is executed, the
virus will infect one .EXE file. Infected files will increase in
length between 516 and 526 bytes with the virus's code appended to the
end of the file. If the virus could not find an .EXE file to infect,
it will leave the drive "spinning" as it will be in an endless loop
looking for a file to infect.
Interestingly enough, this virus will only infect files located on the
A: drive.
Infected files will also have their date/time in the disk directory
changed to the date and time when the infection occurred.
SVir, at least in the three known variants, does not do anything
malicious, it simply replicates.
Known variants of SVir are:
SVir-A : The original "virus" from Poland in early 1990 which did not
replicate.
SVir-B : A variant isolated in August, 1990 which has the bug in SVir-A
fixed so that it will now replicate.
SVir-0 : A variant received in April, 1991, this variant is very
similar to SVir-B. When an infected program is executed, the
virus may infect either 1 or 2 previously uninfected .EXE
files in the current directory. Execution of some infected
programs may result in a system hang.
Virus Name: Swap
Aliases:
Falling Letters Boot, Israeli Boot
V Status:
Rare
Discovered: August, 1989
Symptoms:
Graphic display, BSC (floppy only), TSR, bad cluster,
Origin:
Israel
Eff Length: N/A
Type Code: RsF - Resident Floppy Boot Sector Infector
Detection Method: ViruScan, F-Prot, IBM Scan, VirexPC, VirHunt 2.0+
Removal Instructions: MDisk, CleanUp, F-Prot, or DOS SYS Command
General Comments:
The Swap Virus, or Israeli Boot Virus, was first reported in
August 1989. This virus is a memory resident boot sector
infector that only infects floppies. The floppy's boot
sector is infected the first time it is accessed. One bad
cluster will be written on track 39, sectors 6 and 7 with the
head unspecified. If track 39, sectors 6 and 7, are not
empty, the virus will not infect the disk. Once the virus
is memory resident, it uses 2K or RAM. The actual length of
the viral code is 740 bytes.
The Swap virus activates after being memory resident for 10
minutes. A cascading effect of letters and characters on the
system monitor is then seen, similar to the cascading effect
of the Cascade and Traceback viruses.
The virus was named the Swap virus because the first isolated
case had the following phrase located at bytes 00B7-00E4 on
track 39, sector 7:
"The Swapping-Virus. (C) June, 1989 by the CIA"
However, this phrase is not found on diskettes which have been
freshly infected by the Swap virus.
A diskette infected with the Swap virus can be easily identified
by looking at the boot sector with a sector editor, such as
Norton Utilities. The error messages which normally occur at
the end of the boot sector will not be there, instead the start
of the virus code is present. The remainder of the viral code
is located on track 39, sectors 6 and 7.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Swedish Disaster
Rare
January, 1991
BSC; Partition Table Altered;
Decrease in system and available free memory
Origin:
Sweden
Eff Length: N/A
Type Code: BRhX - Resident Boot Sector & Partition Table Infector
Detection Method: ViruScan V74+
Removal Instructions: MDisk/P
General Comments:
The Swedish Disaster was isolated in January, 1991. This virus appears
to be from Sweden. It is a memory resident infector of floppy boot
sectors and the hard disk partition table.
When the system is booted from a diskette whose boot sector is infected
with the Swedish Disaster Virus, the virus will infect the system
hard disk's partition table, with the original hard disk partition
table moved to side 0, cylinder 0, sector 6. The virus will also
install itself memory resident at the top of system memory but below
the 640K DOS boundary. Total system memory will decrease by 2,048
bytes, available free memory will be 6,944 bytes less than what is
expected by the user. Interrupt 12's return will have been moved by
the virus.
After Swedish Disaster is memory resident, the virus will infect all
non-write protected diskettes which are accessed on the system. On
360K 5.25" diskettes, the original boot sector will have been moved
to sector 11, which is normally a part of the root directory. This
means that if the disk originally had directory entries in that sector,
they will be lost.
The following text string can be found at the end of the boot sector
of infected diskettes, as well as within the partition table on infected
hard disks:
"The Swedish Disaster"
Diskettes infected with the Swedish Disaster can be disinfected by
powering off the system and rebooting from a write-protected original
DOS diskette. The DOS Sys command can then be used to replace the
boot sector on infected diskettes. For hard disks, the MDisk/P program
will remove this virus, though the above text string will remain in
the partition table.
Virus Name: Swiss 143
Aliases:
V Status:
Rare
Discovered: January, 1991
Symptoms:
.COM growth; File date/time changes
Origin:
Switzerland
Eff Length: 143 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Swiss 143 Virus was submitted in January, 1991, by Dany Schoch of
Hagendern, Switzerland. This virus is a non-memory resident infector
of .COM files, including COMMAND.COM.
When a program infected with Swiss 143 is executed, the virus will
infect all .COM files in the current directory. Infected programs
will increase in length by 143 bytes, the virus will be located at the
end of the infected program. The disk directory date and time will also
be altered to the current system date and time when the programs were
infected.
This virus does not do anything besides replicate.
Virus Name: SysLock
Aliases:
3551, 3555
V Status:
Endangered
Discovered: November, 1988
Symptoms:
.COM & .EXE growth, data file corruption
Origin:
Eff Length: 3,551 Bytes
Type Code: PNA - Encrypting Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Pro-Scan, AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: Scan/D, or F-Prot
General Comments:
The SysLock virus is a parasitic encrypting virus which
infects both .COM and .EXE files, as well as damaging some
data files on infected systems. This virus does not install
itself memory resident, but instead searches through the
.COM and .EXE files and subdirectories on the current disk,
picking one executable file at random to infect. The
infected file will have its length increased by approximately
3,551 bytes, though it may vary slightly depending on file
infected.
The SysLock virus will damage files by searching for the word
"Microsoft" in any combination of upper and lower case
characters, and when found replace the word with "MACROSOFT".
If the SysLock virus finds that an environment variable
"SYSLOCK" exists in the system and has been set to "@" (hex 40),
the virus will not infect any programs or perform string
replacements, but will instead pass control to its host
immediately.
Known variant(s) of SysLock are:
Advent : Reported to be a Syslock variant, the sample of this virus
received by the author does not replicate. All known
samples of this virus available from anti-viral researchers
also do not replicate. Fridrik Skulason of Iceland has
indicated that this virus will only replicate it is on an
infected .EXE file, and then it will only infect .COM
files. This variant is thought to be extinct.
Macho-A : same as the SysLock virus, except that "Microsoft"
is replaced with "MACHOSOFT".
Also see: Cookie
Virus Name: Taiwan
Aliases:
Taiwan 2, Taiwan-B
V Status:
Endangered
Discovered: January, 1990
Symptoms:
.COM growth, 8th day any month corrupts BOOT, FAT,
& Partition tables.
Origin:
Taiwan
Eff Length: 743 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V56+, F-Prot, Pro-Scan 1.4+, VirexPC, NAV
Removal Instructions: Scan/D, F-Prot 1.12+, NAV, or delete infected files
General Comments:
The Taiwan virus was first isolated in January, 1990 in
Taiwan, R.O.C. This virus infects .COM files, including
COMMAND.COM, and does not install itself into system memory.
Each time a program infected with the Taiwan virus is executed, the
virus will attempt to infect up to 3 .COM files. The current
default directory is not first infected, instead the virus will
start its search for candidate files in the C: drive root directory.
Once an uninfected .COM file is located, the virus infects the file
by copying the viral code to the first 743 bytes of the file, the
original first 743 bytes of the file is relocated to the end of the
.COM file. A bug exists in this virus, if the uninfected .COM file
is less than 743 bytes in length, the resulting infected .COM file
will always be 1,486 bytes in length. This effect is due to the
virus not checking to see if it read less than 743 bytes of the
original file before infecting it.
The Taiwan virus is destructive. On the 8th day of any month, when
an infected program is run the virus will perform an absolute disk
write for 160 sectors starting at logical sector 0 on the C: and
D: drives. In effect, this logical write will result in the FATs
and root directory being overwritten.
Known variant(s) of Taiwan include:
Taiwan-B : Apparently an earlier version of the Taiwan virus, this
variant will hang the system when infected files are
executed, but after it has infected another file using
the selection mechanism indicated for the Taiwan virus.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Taiwan 3
Rare
June, 1990
.COM & .EXE growth, decrease in available free memory,
system hangs
Origin:
Taiwan
Eff Length: 2,900 Bytes
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V64+, Pro-Scan 2.01+
Removal Instructions: Clean-Up V71+, Scan/D, or delete infected files
General Comments:
The Taiwan 3 Virus was isolated in June, 1990 in Taiwan, R.O.C. It
was dubbed the Taiwan 3 Virus by John McAfee because it is the third
virus from Taiwan, the other two are Taiwan and Disk Killer. This
virus is not related to either of these two viruses.
The first time a program infected with the Taiwan 3 Virus is executed
on a system, the virus will install itself memory resident in low
system free memory. Available free memory will decrease by 3,152
"ACAD.EXECOMMAND.COM".
Virus Name: Tester
Aliases:
TestVir
V Status:
New
Discovered: April, 1991
Symptoms:
.COM growth; Messages
Origin:
United States
Eff Length: 1,000 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V76+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Tester, or TestVir, Virus was received in April, 1991. Its origin
is unknown. This virus is a non-resident infector of .COM files. It
will infect COMMAND.COM.
When a program infected with Tester is executed, the virus will display
the following messages, requiring a response by the system user:
"This is TESTVIRUS B V1.4 !
1 = infect COM-files of this directory + run orig. prog.
5 = run only orig. program
9 = abort"
If a "1" is entered by the system user, the virus will then infect all
of the .COM programs in the current directory, and then execute the
original program. When Tester infects .COM programs, it will display
one of the following two lines, indicating which .COM program it is
currently processing. The first line is displayed for the program if
it was previously infected, the second line only if it is currently
infecting the program:
"Already infected: xxxxxxxx.COM"
"INFECTED: ------> xxxxxxxx.COM"
Entering a "5" will result in no additional programs being infected, and
the original program is executed. Finally, entering a "9" will result
in the program terminating and the user being returned to a DOS prompt.
Programs infected with Tester will increase in size by 1,000 bytes, the
virus will be located at the beginning of the infected file. The
program's date and time in the DOS disk directory will have also been
updated to the date and time when infection occurred.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
The Plague
Rare
January, 1991
"Program too big to fit in memory" message;
Programs do not execute properly; Long disk accesses;
Message and disk overwrite
Origin:
United States
Eff Length: 590 Bytes
Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The Plague Virus was isolated in January, 1991 in the United States.
This virus is a non-memory resident infector of .COM and .EXE files,
including COMMAND.COM.
When a program infected with The Plague is executed, the virus will
attempt to infect up to three programs on the current drive, starting
in the current directory. Infected programs can be either .COM or
.EXE files, and COMMAND.COM can become infected. This virus is an
overwriting virus. It replaces the first 590 bytes of the program
being infected with a copy of itself. The file date and time in the
disk directory are not altered.
Programs infected with The Plague will not function properly. For .EXE
files, the following message will usually be displayed upon program
execution:
"Program too big to fit in memory"
This message may also occur for some .COM programs, but not usually.
The Plague activates when an infected program is
not find an uninfected program to infect, though
randomness to whether or not the activation will
When this virus activates, the following message
Tiny-133.
The first time a file infected with one of the Tiny Family viruses
is executed on a system, the virus will install itself memory resident
at memory segment 60h. This area of memory is normally only used by
DOS when the system is booted, after that it is never used or
referenced. Interrupt 21 will be hooked by the virus.
After the virus is memory resident, the virus will infect any .COM
program that is executed. Infected programs will have a file length
increase of between 134 - 198 bytes, depending on which variant is
present on the system. The file's date and time in the directory will
also have been updated to the system date and time when the infection
occurred.
The Tiny Family of Viruses currently does not do anything but
replicate.
The viruses in this "family" are not related to the Tiny Virus
documented below.
Known members of the Tiny Family are:
Tiny-133 : Similar to Tiny-134, this variant's effective length is
133 bytes. The bugs in Tiny-134 have been fixed, this
virus is an excellent replicator. This variant has also
been altered so that it cannot be detected by anti-viral
utilities which were aware of other members of this family.
Tiny-134 : This variant's effective length is 134 bytes. This
variant is the only member of this family which is not
a very viable virus, it will usually hang the system
when it attempts to infect .COM files.
Tiny-138 : Same as above, effective length is 138 bytes.
Tiny-143 : Same as above, effective length is 143 bytes.
Tiny-154 : Same as above, effective length is 154 bytes.
Tiny-156 : Same as above, effective length is 156 bytes.
Tiny-158 : Same as above, effective length is 158 bytes.
Tiny-159 : Same as above, effective length is 159 bytes.
Tiny-160 : Same as above, effective length is 160 bytes.
Tiny-167 : Same as above, effective length is 167 bytes.
Tiny-198 : Same as above, effective length is 198 bytes.
Also see: Tiny Virus
Virus Name: Tiny Virus
Aliases:
163 COM Virus, Tiny 163 Virus
V Status:
Rare
Discovery: June, 1990
Symptoms:
COMMAND.COM & .COM file growth
Origin:
Denmark
Eff Length: 163 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V64+, VirexPC, F-Prot 1.12+, NAV
Removal Instructions: Scan/D, F-Prot 1.12+, or Delete infected files
General Comments:
The 163 COM Virus, or Tiny Virus, was isolated by Fridrik Skulason
of Iceland in June 1990. This virus is a non-resident generic
.COM file infector, and it will infect COMMAND.COM.
The first time a file infected with the 163 COM Virus is executed,
the virus will attempt to infect the first .COM file in the
current directory. On bootable diskettes, this file will normally
be COMMAND.COM. After the first .COM file is infected, each time
an infected program is executed another .COM file will attempt to
be infected. Files are infected only if their original length is
greater than approximately 1K bytes.
Infected .COM files will increase in length by 163 bytes, and have
date/time stamps in the directory changed to the date/time the
infection occurred. Infected files will also always end with this
hex string: '2A2E434F4D00'.
This virus currently does nothing but replicate, and is the
smallest MS-DOS virus known as of its isolation date.
The Tiny Virus may or may not be related to the Tiny Family documented
elsewhere in this listing.
Also see: Tiny Family
Virus Name: Traceback
Aliases:
3066
V Status:
Extinct
Discovered: October, 1988
Symptoms:
.COM & .EXE growth, TSR, graphic display 1 hour after boot
Origin:
Eff Length: 3,066 bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: M-3066, VirClean, F-Prot, VirexPC, Pro-Scan 1.4+,
VirHunt 2.0+, NAV, or delete infected files
General Comments:
The Traceback virus infects both .COM and .EXE files, adding
3,066 bytes to the length of the file. After an infected
program is executed, it will install itself memory resident
and infect other programs that are opened. Additionally, if
the system date is after December 5, 1988, it will attempt to
infect one additional .COM or .EXE file in the current
directory. If an uninfected file doesn't exist in the current
directory, it will search the entire disk, starting at the
root directory, looking for a candidate. This search
process terminates if it encounters an infected file before
finding a candidate non-infected file.
This virus derives its name from two characteristics. First,
infected files contain the directory path of the file causing
the infection within the viral code, thus is it possible
to "trace back" the infection through a number of files. Second,
when it succeeds in infected another file, the virus will
attempt to access the on-disk copy of the program that the
copy of the virus in memory was loaded from so that it can
update a counter in the virus. The virus takes over disk
error handling while trying to update the original infected
program, so if it can't infect it, the user will be unaware
that an error occurred.
The primary symptom of the Traceback virus having infected
the system is that if the system date is after December 28,
Turbo Kukac
Kukac, Turbo Kukac 9.9, Polish-2
Rare
November, 1990
.COM growth; Decrease in total system and free available memory;
File not found errors with some utilities.
Origin:
Hungary
Eff Length: 512 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V71+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Turbo Kukac, or Kukac, Virus was discovered in Hungary in November,
1990. This virus is a memory resident infector of .COM files, including
COMMAND.COM. It is very similar to the Turbo 448 Virus.
The first time a program infected with the Turbo Kukac Virus is executed,
the virus will install itself memory resident following the Command
Interpretor and any previously loaded TSRs. Total system memory and
available free memory will decrease by 1,040 bytes. Interrupts 05 and
21 will be hooked by the virus. Note that this virus does not use a low
system memory TSR, but instead creates a sort of "hole" in memory for
its usage.
Like the Turbo 448 Virus, this virus does not infect program when
they are executed. Instead, it infects .COM files when they are openned
for some other reason besides execution. For example, if the virus is
memory resident a program A.COM is copied to B.COM, both programs will
become infected by the virus.
Infected files will increase in length by 512 bytes with the virus being
located at the end of the file. The program's date and time in the
directory will also have been updated to the system date and time when
the file was infected. The following text string can be found at the
end of all infected programs:
"Turbo Kukac 9.9
$"
impact printouts only, the screen display and data in files are
not affected.
The Typo Boot virus is similar structurally to the Ping Pong
virus, and may be a variant of Ping Pong. It can be removed
from a disk by using MDisk, CleanUp, DOS SYS command, or
just about any Ping Pong disinfector.
Virus Name: Typo COM
Aliases:
Fumble, 867
V Status:
Extinct
Discovered: November, 1989
Symptoms:
.COM growth, Resident TOM, garbled printout (see text).
Origin:
England
Eff Length: 867 Bytes
Type Code: PRtC - Parasitic Resident .COM Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan, AVTK 3.5+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D/X, F-Prot, Pro-Scan 1.4+, VirHunt 2.0+,
or delete infected files
General Comments:
The Typo COM virus is similar to the Typo Boot virus in that
it will garble data that is sent to the parallel port once it
has activated. Unlike the Boot virus, the COM virus infects
generic .COM files. This virus was first reported by Joe
Hirst of Brighton, UK, in November, 1989.
The Typo COM virus only infects .COM files on even-numbered
days.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
USSR
Rare
October, 1990
.EXE growth; hard disk boot sector and partition table damage;
system hangs; long program load times
Origin:
USSR
Eff Length: 576 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan V71+, Pro-Scan 2.01+
Removal Instructions: Scan/D, or Delete infected Files
General Comments:
The USSR Virus was discovered in October, 1990 in the USSR. It is
an encrypted, non-resident generic infector of .EXE files.
Each time a program infected with the USSR Virus is executed, it will
search the currect directory for the first uninfected .EXE file. If
it finds one, it will attempt to infect it. Sometimes when the virus
attempts to infect a file, it will hang the system leaving the drive
light on, however most of the time the virus is successful. Infected
files will increase in length by 576 to 586 bytes, with the virus
located at the end of the file.
Systems infected with this virus may go to boot their system from its
hard disk only to find that the hard disk's boot sector has been
removed, and the partition table has been damaged, thus rendering the
hard disk inaccessible. This damage can be repaired using Norton
Disk Doctor, or MDisk with the /P option.
Infected systems will also experience longer than normal load times
when infected programs are executed. The longer than normal load time
is due to the virus searching for a file to infect, and then infecting
the candidate file if one was found.
Virus Name: USSR 311
Aliases:
V-311
V Status:
Rare
Discovered: January, 1991
Symptoms:
.COM growth; COMMAND.COM renamed to COMMAND.CON
Origin:
USSR
Eff Length: 311 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The USSR 311, or V-311, Virus was submitted in January, 1991. It
originated in the USSR. This virus is a non-resident infector of .COM
programs, including COMMAND.COM.
When a program infected with USSR 311 is executed, the virus will check
the system time to see if the seconds value is equal to one of 16
values. If it was equal to one of those 16 values, COMMAND.COM will be
renamed to COMMAND.CON. Whether or not the rename of COMMAND.COM
occurred, the virus will then infect one .COM program in the current
directory.
Infected .COM programs will increase in length by 311 bytes, the virus
will be located at the end of the infected file. The file's time in
the disk directory will also be modified to be 11:19:32, the infection
marker for this virus. The file date in the directory is not altered.
USSR 3111 will also alter the file attributes for the file in the
directory. In particular, bits 8 thru 15 will be reset, which may
produce unexpected results in environments that make use of these
bits.
Virus Name: USSR 492
Aliases:
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM file growth; File date/time changes
Origin:
USSR
Eff Length: 495 - 508 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The USSR 492 Virus was submitted in December, 1990 and is from the
USSR. This virus is a memory resident .COM file infector, it will
infect COMMAND.COM.
When the first program infected with USSR 492 is executed, the virus
will install itself memory resident in high system memory, but below
the 640K DOS boundary. This memory is not reserved by the virus.
Interrupt 21 will be hooked by the virus. At the time of going memory
resident, the virus will check to determine if COMMAND.COM on the C:
When the first program infected with USSR 600 is executed, the virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. The DOS ChkDsk program will indicate
that total system memory and available free memory are 2,048 bytes
less than expected. This virus does not move the interrupt 12
return. USSR 600 uses interrupts 21 and 24.
Once USSR 600 is memory resident, it will infect .COM programs which
are executed if they have an original file length of at least 600
bytes. Infected files will increase in size by 600 bytes, and the
virus's code will be located at the beginning of the infected program.
It is unknown if this virus does anything besides replicate.
Virus Name: USSR 707
Aliases:
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM file growth; decrease in total system and available memory
Origin:
USSR
Eff Length: 707 Bytes
Type Code: PRtCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The USSR 707 Virus was submitted in December, 1990. It is from the
USSR. This virus is a memory resident infector of .COM programs,
including COMMAND.COM.
When the first program infected with the USSR 707 Virus is executed,
this virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. It will move the interrupt 12
return so that the virus in memory cannot be overwritten. USSR 707
makes use of interrupt 21, which will now map to the virus in high
system memory. Total system memory and available free memory will
be 720 bytes less than expected.
After USSR 707 is memory resident, any .COM program executed will
become infected by the virus. Infected .COM programs will have a
file length increase of 707 bytes, the virus will be located at the
end of the file. If COMMAND.COM is executed, it will be infected.
It is unknown if USSR 707 does anything besides replicate.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
USSR 711
Rare
December, 1990
.COM file growth; system hangs;
decrease in total system and available memory
Origin:
USSR
Eff Length: 711 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The USSR 711 Virus was submitted in December, 1990, and comes from the
Symptoms:
is
of
be
is
After USSR 1049 is memory resident, the virus will infect .COM and
.EXE files when they are executed. The virus, however, will not infect
very small .EXE files. Infected files will increase in size by
1,051 to 1,064 bytes, the virus will be located at the end of the
infected program.
Systems infected with the USSR 1049 Virus may experience system hangs
when attempting to execute .EXE programs. These hangs occassionally
occur when the virus infects .EXE program, though the program being
infected will actually be infected.
It is unknown if USSR 1049 does anything besides replicate.
Virus Name: USSR 1689
Aliases:
SVC V4.00
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM & .EXE growth; system hangs
Origin:
USSR
Eff Length: 1,689 Bytes
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The USSR 1689 Virus was received in December, 1990. It is from the
USSR. This virus is not a very viable virus, though it does infect
both .COM and .EXE programs.
When the first program infected with USSR 1689 is executed, this virus
will install itself memory resident in the in-memory command
interpretor.
After the virus is memory resident, the virus will infect the next
.COM or .EXE program executed, though a system hang will also occur.
Infected programs will increase in size by 1,689 bytes, though on files
larger than 1,689 bytes, the virus will hide the file length increase
if the virus is already in memory. Files originally smaller than 1,689
bytes will indicate a file size increase in the DOS directory when the
virus is resident. In all cases, the virus will be located at the end
of infected programs.
With the system hang which occurs each time a program is infected by
this virus, it is not a very viable virus, and should not be considered
a threat in its current state.
Virus Name: USSR 2144
Aliases:
V Status:
Rare
Discovered: December, 1990
Symptoms:
.COM & .EXE growth; decrease in total system and available memory
Origin:
USSR
Eff Length: 2,144 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The USSR 2144 Virus was submitted in December, 1990, and is from the
USSR. This virus is a memory resident infector of .COM and .EXE files,
including COMMAND.COM.
When the first program infected with the USSR 2144 Virus is executed,
the virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. The DOS ChkDsk program will
indicate memory values that show 4,608 bytes less total system memory
and available free memory than expected. This virus does not move
the interrupt 12 return. The virus also directly alters the interrupt
page in memory so that some interrupts will now execute the virus's
code.
After USSR 2144 is memory resident, and program which was originally
greater in length than 2K that is executed or openned for reason will
become infected by the virus. Infected .COM programs will increase in
length by 2,144 bytes. .EXE programs will increase in length by 2,144
to 2,59 bytes. In both cases, the virus will be located at the end
of infected files. Infected files will not have their date and time in
the disk directory altered, and this virus does not hide the change in
file length of infected files.
It is unknown if USSR 2144 does anything besides replicate.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
V651
Eddie 3, Stealth Virus
Rare
April, 1990
.COM & .EXE growth, decrease in system and free memory,
file allocation errors
Origin:
Sofia, Bulgaria
Eff Length: 651 Bytes
Type Code: PRtA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V66+, VirHunt 2.0+
Removal Instructions: Scan/D, VirHunt 2.0+, or Delete infected files
General Comments:
The V651, or Eddie 3, Virus was isolated in Sofia, Bulgaria in
April 1990 by Vesselin Bontchev. V651 is believed to have been
written by the same author as Dark Avenger, V1024, and V2000.
This virus is a generic infector for .COM and .EXE files.
The first time a program infected with V651 is executed, the virus
will install itself memory resident. Using the DOS CHKDSK program,
V2000
Dark Avenger II, Stealth Virus, Travel Virus
Rare
1989
TSR; .COM, .EXE, .OV? growth (see text); crashes;
crosslinked files following CHKDSK.
Origin:
Bulgaria
Eff Length: 2,000 Bytes
Type Code: PRA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V59+, Pro-Scan 1.4+, AVTK 3.5+, VirHunt 2.0+,
NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, NAV, or delete infected files
General Comments:
The V2000, or Dark Avenger II, virus is a memory resident generic
file infector. The first isolated samples of this virus were
received from Bulgaria, where it was isolated by Daniel Kalchev
and Niki Spahiev.
V2000 will infect .COM, .EXE, and Overlay files, as well as
COMMAND.COM. When the first infected file is executed, the virus
installs itself memory resident, and then infected COMMAND.COM if
it has not already been infected. Then, when an executable file
is opened for any reason, it is infected if it hasn't been
previously infected.
Increased file lengths will not be shown if the V2000 virus is
present in memory when a DIR command is issued. Issuing a
CHKDSK /F command on infected systems may result in crosslinking
of files since the directory information may not appear to match
the entries in the file allocation table (FAT).
Systems infected with the V2000 virus will experience unexpected
system crashes, resulting in lost data. Some systems may also
become unbootable due to the modification of COMMAND.COM or the
hidden system files.
One of the following two text strings will appear in the viral code
in infected files, thus accounting for the alias of Travel Virus used in
Bulgaria:
"Zopy me - I want to travel"
"Copy me - I want to travel"
There are
hangs the
attempted
following
reports from Bulgaria that the V2000 virus looks for and
system if programs written by Vesselin Bontchev are
to be executed. This would explain the presence of the
copyright notice within the viral code:
V2P6Z
Research
August, 1990
.COM file growth
Minnesota, USA
2,076 - 2,364 Bytes
VFSI
437, Happy Day
Rare
September, 1990
.COM growth; message
Bulgaria
437 Bytes
Victor
Rare
May, 1990
.COM &.EXE growth, data file corruption, file linkage errors,
and unexpected system reboots
Origin:
USSR
Eff Length: 2,458 bytes
Type Code: PRAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V63+, Pro-Scan 1.4+, VirexPC, F-Prot 1.12+, NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, F-Prot 1.12+, NAV, or
Delete infected files
General Comments:
The Victor Virus was first isolated in May, 1990. It is believed
to have originated in the USSR due to messages which appear within
Violator B4
Christmas Violator, Violator Strain B4
Rare
December, 1990
.COM growth on 8088 based system;
Hard Disk Corruption on 80286 & 80386 based systems
Origin:
United States
Eff Length: 5,302 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Violator B4 Virus was isolated in December, 1990 in the United
States. This virus was originally released into the public domain
on a trojan version of DSZ (DSZ1203). It is a non-resident infector
of .COM files, including COMMAND.COM.
What Violator B4 does depends on what processor is in the personal
computer it is being executed on. On 80286 and above processors, the
virus will activate immediately, overwriting the beginning portion of
the system hard disk. It will also attempt to display a Christmas
greeting at that time, but the greeting display will be garbled if
Ansi.Sys is not loaded. Damage caused by Violator B4 at activation
can be repaired using Norton Disk Doctor.
On an 8088 based system, Violator B4 will do nothing but replicate.
Each time an infected program is executed, the virus will infect one
other .COM program in the current directory. Violator B4 infected
files will have a file length increase of 5,302 bytes. The file's
date and time in the disk directory will not be altered. The virus
will be located at the end of the infected file.
The following text message is contained within the Violator B4 virus,
though it is never displayed:
"Violator Strain B4 - Written by RABID Nat'nl Development Corp.
RABID would like to take this opportunity to extend it's sincerest
holiday wishes to all Pir8 lamers around the world! If you are
reading this, then you are lame!!!
Anyway, to John McAffe! Have a Merry Christmas and a virus filled
new year. Go ahead! Make our day!
Remember! In the festive season, Say No to drugs!!! They suck shit!
(Bah! We make a virus this large, might as well have
something positive!)"
Virus Name: VirDem
Aliases:
VirDem 2
V Status:
Endangered
Discovered: 1986-1987
Symptoms:
.COM growth, Messages
Origin:
Germany
Eff Length: 1,236 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: VirexPC, AVTK 3.5+, F-Prot 1.12+, ViruScan V71+,
VirHunt 2.0+, Pro-Scan 2.01+, NAV
Removal Instructions: F-Prot 1.12+, Scan/D, or Delete infected files
General Comments:
The VirDem Virus was written in 1986-1987 by Ralf Burger of Germany.
The virus was originally distributed in Europe as a demonstration
virus, to assist computer users in understanding how a computer
virus operates.
The VirDem virus is not memory resident, and only infects .COM files
on the A: drive. It will always skip the first .COM file in the
root directory, so normally it will not infect COMMAND.COM. It will
also not infect .COM files past the second subdirectory on the disk.
Infected files that were originally less than approximately 1,500
bytes will be 2,616 bytes after infection. .COM files which were
greater than 1,500 bytes will increase in size by approximately
1,236 bytes.
When an infected program is executed, VirDem will infect the next
candidate .COM file. Infected files will contain the viral code,
followed by the original program. After infecting the .COM file,
the virus will play a "game" with you, starting with the following
text being displayed:
" VirDem Ver.: 1.06 (Generation #) aktive.
Copyright by R.Burger 1986,1987
Phone.: D - xxxxx/xxxx
This is a demoprogram for
computerviruses. Please put in a
number now.
If you're right, you'll be
able to continue.
The number is between
0 and #
"
"
If you guess the correct number, you receive the following message
and your program then executes:
" Famous. You're right.
You'll be able to continue. "
Finally, after all the candidate .COM files on the A: drive are
infected, the following message is displayed:
" All your programs are
struck by VIRDEM.COM now."
VIRDEM.COM was the original distribution file containing the virus,
and had a VIRDEM.DOC file included with it. VirDem is not widespread,
and is not destructive.
Known variant(s) of VirDem include:
VirDem 2 : Similar to the virus described above, the major difference
is that the text messages have been translated to German.
Also see: Burger
Virus Name: Virus-90
Aliases:
V Status:
Research
Discovered: December, 1989
Symptoms:
.COM growth, TSR
Origin:
District of Columbia, USA
Eff Length: 857 bytes
Type Code: PRC - Parasitic Resident .COM Infector
Detection Method: ViruScan/X V67+, F-Prot, IBM Scan, Pro-Scan 1.4+, VirexPC,
AVTK 3.5+, NAV
Removal Instructions: Scan/D/X, F-Prot, Pro-Scan 1.4+,
or delete infected files
General Comments:
The Virus-90 virus was originally distributed in December, 1989
by Patrick Toulme as an "educational tool", with the virus
source also available for sale. In January, 1990, the
author contacted the sites where he had uploaded the virus
requesting that they remove it from their systems, his having
decided a live virus was not a "good idea" for an educational
tool after being contacted by several viral authorities.
The following description was submitted by Patrick Toulme in
November 1990 for inclusion in this listing:
"This educational, research virus was written by Patrick Toulme
to aid developers in understanding direct-virus action and in
creating virus-resistant software. This virus is a simple COM
infector that will not infect a hard drive and advises the user
when a file on a floppy disk is to be infected. Of course, no
damage occurs from the virus and all infected files advise the
user of the infection upon execution. The safeguards provided by
the author prevent accidental infection and the dis-assembly of the
code is extremely difficult. Upon request from the anti-viral
community, Virus-90 is now only available to approved anti-virus
researchers."
Also see: Virus101
Virus Name: Virus101
Aliases:
V Status:
Research
Discovered: January, 1990
Symptoms:
TSR, BSC, .COM growth (floppy only)
Origin:
District of Columbia, USA
Eff Length: 2,560 Bytes
Type Code: PRAFK - Parasitic Resident Infector
Detection Method: ViruScan/X V67+, Pro-Scan 1.4+, F-Prot 1.12+, VirHunt 2.0+,
NAV
Removal Instructions: Scan/D/X or delete infected files
General Comments:
The Virus101 is the "big brother" of Virus-90, also written by
Patrick Toulme as an "educational tool" in January 1990.
This virus is memory resident, and employs an encryption scheme
to avoid detection on files. It infects COMMAND.COM, and all
other executable file types. Once it has infected all the
files on a diskette, it will infect the diskette's boot
sector. It only infects floppy diskettes in its current
version.
The following description was submitted by Patrick Toulme for
inclusion in this listing in November 1990:
"Virus-101 is a sophisticated, continually encrypting, research
virus written by Patrick Toulme, author of Virus-90. Virus-101
infects both COM and EXE files and will evade most anti-virus
software and will continually encrypt itself to prevent
non-algorithmic search scans. This virus is not available to the
general public and is presently used by government agencies and
corporate security departments to test anti-virus software and
hardware devices."
Also see: Virus-90
Virus Name: Voronezh
Aliases:
V Status:
Rare
Discovered: December 1990
Symptoms:
.COM & .EXE growth; decrease in total system and available memory
Origin:
USSR
Eff Length: 1,600 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V74+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Voronezh Virus was received in December, 1990. It is originally
from the USSR. Voronezh is a memory resident infector of .COM and
.EXE files, and does not infect COMMAND.COM.
The first time a program infected with Voronezh is executed the virus
will install itself memory resident. This virus will be resident at
the top of system memory but below the 640K DOS boundary. While the
virus reserves 3,744 bytes of memory for itself, it does not move the
interrupt 12 return. Interrupt 21 will be hooked by the virus. This
virus may also reserve 24 bytes of display memory on the display
adapter card.
After Voronezh is memory resident, .COM and .EXE files will be
infected when they are executed. Infected files will increase in
length by 1,600 bytes, the virus will be located at the end of
infected programs. Infected programs will also contain the
text string:
"Voronezh,1990 2.01".
It is unknown if this virus does anything besides replicate.
Known variant(s) of Voronezh are:
Voronezh B: Similar to the Voronezh Virus described above, the major
difference with Voronezh B is that Voronezh B will infect files
when they are executed or openned for any reason. The original
virus did not infect on file open. The text string indicated
for Voronezh is also found in this variant.
Virus Name: VP
Aliases:
V Status:
Rare
Discovered: May 1990
Symptoms:
COMMAND.COM & .COM file growth, system slowdown
Origin:
England
Eff Length: 913 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V64+, Pro-Scan 1.4+, AVTK 3.5+, F-Prot 1.12+,
VirHunt 2.0+, NAV
Removal Instructions: Scan/D, Pro-Scan 1.4+, F-Prot 1.12+, VirHunt 2.0+, or
Delete infected files
General Comments:
The VP Virus was first isolated in May, 1990. It is a non-resident
generic .COM infector, and will infect COMMAND.COM. When an
infected program is run, the virus will attempt to locate and
infect another .COM file. In some cases, such as COMMAND.COM, the
virus will display the contents of the program being infected. In
other cases, the virus may attempt to execute the program being
infected. Infected files increase in length by 913 bytes, and
can be identified as the following hex string will appear near both
the beginning and the end of an infected program: '4503EB1808655650'.
Virus Name: W13
Aliases:
Toothless Virus, W13-A
V Status:
Endangered
Discovered: December, 1989
Symptoms:
.COM growth
Origin:
Poland
Eff Length: 534 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V63+, F-Prot, IBM Scan, Pro-Scan 1.4+, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: Scan/D, F-Prot, Pro-Scan 1.4+, VirHunt 2.0+, NAV,
or delete infected files
General Comments:
The W13 virus is a .COM file infector that doesn't do much
except for infect files. The virus was isolated in December
1989 in Poland.
While W13 is based on the Vienna virus, it does not damage files
or have some of the other side effects of the Vienna virus. It
contains a number of bugs which prevent it from being a good
replicator.
Known variant(s) of W13 include:
W13-B
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Rare
August, 1990
.COM & .EXE growth; TSR; system slowdown; black window;
file deletion on Friday The 13ths
Origin:
Westwood, California, USA
Eff Length: 1,819 - 1,829 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V67+, F-Prot 1.12+, Pro-Scan 2.01+, NAV
Removal Instructions: Scan/D, CleanUp, NAV, or Delete infected files
General Comments:
The Westwood Virus was isolated in August, 1990 in Westwood, California.
This virus is a substantially altered variant of the Jerusalem B virus,
enough so that all anti-virals tested which could detect Jerusalem B
were unable to identify it. Like Jerusalem, it infects .COM, .EXE, and
overlay files, but not COMMAND.COM.
The first time a program infected with the Westwood virus is executed,
the virus will install itself memory resident as a low system memory
TSR of 1,808 bytes. Interrupts 8 and 21 will be hooked. If the
system date happens to be a Friday The 13th, interrupt 22 will also
be hooked.
After the virus is memory resident, any program which is executed
will become infected with the Westwood virus. .COM files will
increase by 1,829 bytes with the virus's code located at the beginning
of the infected program. .EXE files and overlay files are infected
with the virus's code added to the end of the program. .EXE files
increase in length by between 1,819 and 1,829 bytes. Unlike most
variants of the Jerusalem virus, Westwood does not reinfect .EXE files.
Infected systems will experience a system slowdown occurring after
the virus has been memory resident for 30 minutes. At this time, the
"black window" or "black box" common to the Jerusalem virus will
appear on the lower left hand side of the system display. Screen
contain around the area of the "box" may be corrupted if screen writes
happened to be occurring when the box appeared.
On Friday The 13ths, the Westwood Virus will delete any programs that
are executed once the virus becomes memory resident.
Also see: Jerusalem B
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Whale
Mother Fish, Stealth Virus, Z The Whale
Research
August, 1990
.COM & .EXE growth; decrease in available memory;
system slowdown; video flicker; slow screen writes;
file allocation errors; simulated system reboot
Origin:
Hamburg, West Germany
Eff Length: 9,216 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V67+, Pro-Scan 2.01+, NAV
when they are copied with the DOS copy command, at other times it
will not "disinfect on the fly".
Occasionally, the Whale Virus will simulate what appears to be a
system reboot. While this doesn't always occur, when it does occur
the Break key is disabled so that the user cannot exit unexpectedly
from the execution of the system's AutoExec.Bat file. If the
AutoExec.Bat file contained any software which does file opens of
other executable programs, those opened executable programs will
be infected at that time if they were not previously infected.
Typically, files infected in this manner will increase by 9,216
bytes though it will not be shown in a directory listing.
A hidden file may be found in the root directory of drive C: on
infected files. This file is not always present, the virus will
sometimes remove it, only to recreate it again at a later time.
The name of this hidden file is FISH-#9.TBL, it contains an
image of the hard disk's partition table along with the following
message:
"Fish Virus #9
A Whale is no Fish!
Mind her Mutant Fish
and the hidden Fish Eggs
for they are damaging.
The sixth Fish mutates
only if the Whale is in
her Cave."
After the discovery of this hidden file, the author of this
document made several attempt to have the Fish 6 Virus mutate
by introducing it and Whale into a system. Under no circumstances
did a mutation of either virus result, the resultant files were
infected with both an identifiable Fish 6 infection and a Whale
infection.
Whale is hostile to debuggers and contains many traps to prevent
successful decryption of the virus. One of its "traps" is to lock
out the keyboard if it determines a debugger is in use.
Virus Name:
Aliases:
V Status:
Discovered:
Symptoms:
Wisconsin
Death To Pascal
Rare
September, 1990
.COM growth; Message; Write Protect Errors; .PAS files
disappear; file date/time changes
Origin:
Wisconsin, USA
Eff Length: 825 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan V67+, Pro-Scan 2.01+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Wisconsin Virus was received in September, 1990. The origin of
the sample was Wisconsin, which is where its name came from. It is
also reported to have been isolated at about this same time in
California. Wisconsin is a non-resident infector of .COM files, but
it does not infect COMMAND.COM.
When a program infected with the Wisconsin Virus is executed, the virus
will alter the date and time of the program being executed to the
current system date and time. The Wisconsin Virus will then infect
one other .COM file in the current directory. Infected files will
increase in length by 825 bytes, with the viral code located at the
beginning of the file.
If an attempt is made to execute a program infected with the Wisconsin
virus from a write-protected diskette, a write protect error will
occur. This virus does not intercept this error.
Infected programs may display the following message:
"Death to Pascal."
When this message is displayed, any .PAS files located in the
current directory will be deleted. This message cannot be seen in
infected files as it is encrypted.
Virus Name: Wolfman
Aliases:
V Status:
Rare
Discovered: July, 1990
Symptoms:
TSR; .COM & .EXE growth
Origin:
Taiwan
Eff Length: 2,064 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V66+, Pro-Scan 2.01+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Wolfman Virus was discovered in Taiwan in July, 1990. It is a
memory resident generic infector of .COM and .EXE files, but not
COMMAND.COM.
The first time a program infected with the Wolfman Virus is executed,
the virus will install itself memory resident as a TSR with 2 blocks
of memory reserved. The first block of memory reserved is 68,032
bytes in length, the second block of reserved memory is 4,544 bytes
in length. The total 72,640 bytes of memory is in low system memory,
and available free memory is decreased by a corresponding amount.
The virus hooks interrupts 09, 10, 16, 21, 2F, ED, and F5.
Once the virus is memory resident, the virus will infect any .COM or
.EXE file which is executed if the pre-infection file length is
greater than or equal to 2,064 bytes. Infected files increase in
length by 2,064 bytes. .COM files which are infected will have the
virus's code located at the beginning of the .COM file, .EXE files
will have the virus located at the end. Infected files will have
their date and time in the disk directory altered to the system
date and time when infection occurred.
It is unknown when Wolfman activates, or if it is destructive.
Known variant(s) of Wolfman include:
Wolfman 2: This variant is fairly similar to the Wolfman Virus. Its
memory resident TSR is 67,984 bytes, and it hooks interrupts
09, 10, 16, 21, CF, D1, D3, and several others. Files
smaller than 5,120 bytes will not be infected by the virus.
Infected .EXE files will contain the text string "WOlf_mAN",
though this string cannot be found in infected .COM programs
as it will be encrypted.
Virus Name: Yankee Doodle
Aliases:
TP44VIR, Five O'clock Virus
V Status:
Common - Europe
Discovered: September, 1989
Symptoms:
.COM & .EXE growth, melody @ 5 p.m.
Origin:
Austria or Bulgaria
Eff Length: 2,885 or 2,899 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan V42+, F-Prot, IBM Scan, Pro-Scan, VirexPC,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: CleanUp V64+, Scan/D, VirClean, F-Prot, NAV, or
delete infected files
General Comments:
The Yankee Doodle virus was isolated by Alexander Holy of
the North Atlantic Project in Vienna, Austria, on
September 30, 1989. It was also isolated in Bulgaria shortly
thereafter, where it is known as TP44VIR.
This virus is a parasitic virus which infects both .COM and .EXE
files, and installs itself memory resident. After installing itself
memory resident, it will play Yankee Doodle on the system speaker at
17:00. Infected programs will be increased in length by 2,899 bytes.
Other than being disruptive by playing Yankee Doodle, this
virus currently does nothing else harmful besides infecting
files.
As a side note, some variants of the Yankee Doodle Virus will seek
out and modify Ping Pong viruses, changing them so that they selfdestruct after 100 infections.
Known variants of the Yankee Doodle Virus are:
TP33VIR - This variant disables interrupts 1 and 3, thus interfering
with using debuggers to isolate it. The behavior of the
virus also has been changed so that it infected programs
will play Yankee Doodle at 5PM. The second to the last
byte in infected files is the virus's "version number",
in the case of TP33VIR, it is 21h (33 in hex).
TP34VIR - Similar to TP33VIR, except that this variant is memory
resident, and infects programs as they are executed.
The second to the last byte in infected files is 22h.
TP38VIR - Similar to TP34VIR, except that .COM and .EXE files are
handled in a different way, and this variant will
disinfect itself if it is loaded with CodeView active in
memory. The second to the last byte in infected files
is 26h. TP38VIR was first isolated in Bulgaria in
July 1988, and is the oldest virus known in Bulgaria.
TP41VIR - Similar to TP38VIR, except the second to the last byte
in infected files is 29h.
TP42VIR - This variant of Vacsina tests to determine if the system
is infected with the Ping Pong virus, and if it is, will
attempt to disable the Ping Pong virus by modifying it.
The second to the last byte in infected files is now 2Ah.
TP44VIR - Similar to TP42VIR, the second to the last byte of infected
files is 2Ch.
TP45VIR - Similar to TP44VIR, the second to the last byte of infected
files is 2Dh.
Yap Virus
New
March, 1991
.COM growth; TSR; "Bugs" may appear in screen;
Decrease in available free memory
Origin:
USA
Eff Length: 6,258 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan V75+
Removal Instructions: Scan/D, or Delete infected files
General Comments:
The Yap Virus was discovered in March, 1991, in the United States.
Yap is a memory resident .COM file infector. It will infect
COMMAND.COM.
The first time a program infected with the Yap Virus is executed, the
virus will install itself memory resident as a low system memory TSR
of 11,344 bytes. Interrupts 09 and 21 will be hooked by the virus.
After Yap is memory resident, it will infect .COM programs as they
ZK900
Pray
New
April, 1991
.COM & .EXE growth; Decrease in total system & available memory;
Music
Origin:
USA
Eff Length: 900 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method:
Removal Instructions: Delete infected files
General Comments:
The ZK900 Virus was received in April, 1991, from David Chess of IBM.
ZK900 is a memory resident .COM and .EXE infector, and will infect
COMMAND.COM.
The first time a program infected with ZK900 is executed, the virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Interrupts 1C and 21 will be hooked by
the virus.
After becoming memory resident, ZK900 will infect .COM and .EXE
programs as they are executed. If COMMAND.COM is executed, it will
become infected. Infected programs will increase in size by 900 bytes
with the virus being located at the end of the file. The program's
date and time in the disk directory will not be altered by the virus.
Infected programs will end with the text characters "zx".
Systems infected with ZK900 may experience a tune being played every
three to five minutes on the system speaker. The tune is the children's
rhyme "Pray for the dead, and the dead will pray for you".
------------------------------------------------------------------------------Virus Information Summary List
Virus Common Name Cross-Reference
The following is a cross-reference of common virus names back to
the name they are listed by in the virus information section.
Hopefully, this cross-reference will alleviate some confusion when
different anti-viral software packages refer to different names for
the same virus.
Virus Name
---------------------@ Virus
62-B
100 Years Virus
163 COM Virus
217
333
382
382 Recovery Virus
405
437
453
500 Virus
505
509
512
512-A
512-B
512-C
512-D
512-E
512-F
512 Virus
529
541
555
623
632
637
642
646
648
765
834 Virus
834-B
867
903
944
1008
1022
1024-B
1075
1168
1210
1226
1226D
1226M
1253
1260
1280
1374
1381 Virus
1381-B
1392
1514
1536
1539
1554
1559
1575
1575-B
1575-C
1577
1591
1605
1605-B
1624
1701
1704
1704 Format
1704-B
1720
17Y4
1808
1813
1917
1961
1971
2080
2086
2100
2131
2480
2576
2930
2930-B
3012
3066
3066-B
3066-B2
3551
3555
3880
4096
4096-B
4096-C
4711
4870 Overwriting
5120
8920
909090h Virus
9800:0000 Virus
A-204
Advent
Arf
AIDS
AIDS II
AirCop
Akuku
Alabama
Alameda
Ambulance Car
Amoeba Virus
Amstrad
Anarkia
Anarkia-B
Anthrax
AntiCad
1554
1575
1575
1575
1575
1575
1605
1605
Yankee 2
Cascade
Cascade, Cascade-B
1704 Format
Cascade B
1720
Cascade
Jerusalem
Jerusalem
Datacrime IIB
Yankee 2
Eight Tunes
Fu Manchu
Fu Manchu
V2100
2131
Crew-2480
Taiwan 4
Traceback II
Traceback II
Plastique
Traceback
Traceback
Traceback
SysLock
SysLock
Itavir
4096
4096
4096
Perfume
4870 Overwriting
5120
Print Screen
Burger
1554
Jerusalem B
Syslock
Arf
AIDS
AIDS II
AirCop
Akuku
Alabama
Alameda
Ambulance Car
1392
Amstrad
Jerusalem B
Jerusalem B
Anthrax
1253
Anti-Pascal
Anti-Pascal 400
Anti-Pascal 440
Anti-Pascal 480
Anti-Pascal 529
Anti-Pascal 605
Anti-Pascal II
AntiChrist
AP-400
AP-440
AP-480
AP-529
AP-605
April 1st
April 1st-B
Arab
Arab Star
Armagedon
Armagedon The First
Armagedon The Greek
Ashar
Attention!
Australian 403
Austrian
Azusa
Basic Virus
Best Wish
Best Wishes
Best Wishes B
Black Avenger
Black Friday
Black Monday
Blackjack
Blood
Blood 2
Bloody!
Boot
Bouncing Ball
Bouncing Dot
Brain
Brain Slayer
Burger
C-605
Captain Trips
Carioca
Cascade
Cascade-B
Casino
Casper
Century Virus
Chaos
Choinka
Christmas In Japan
Christmas Violator
Christmas Virus
CIA
Columbus Day
COM Virus
Computer Ogre
Cookie
Anti-Pascal
Anti-Pascal II
Anti-Pascal II
Anti-Pascal II
Anti-Pascal
Anti-Pascal
Anti-Pascal II
AntiChrist
Anti-Pascal II
Anti-Pascal II
Anti-Pascal II
Anti-Pascal
Anti-Pascal
Suriv 1.01
Suriv 2.01
834 Virus
Jerusalem B
Armagedon
Armagedon
Armagedon
Ashar
Attention!
Australian 403
Vienna
Azusa
5120
Best Wishes
Best Wishes
Best Wishes
Dark Avenger
Jerusalem
Black Monday
Cascade-B
Blood
Blood
Bloody!
Ping Pong-B
Ping Pong
Ping Pong
Brain
Slayer Family
Burger
Anti-Pascal
Jerusalem B
Carioca
Cascade
Cascade-B
Casino
Casper
4096
Chaos
Father Christmas
Christmas In Japan
Violator B4
Christmas Virus
Burger
Datacrime, Datacrime II, Datacrime IIB, Datacrime-B
Friday The 13th COM Virus
Disk Killer
Cookie
Cracker Jack
Crash
Crew-2480
Cunning
Cursy
Dark Avenger
Dark Avenger-B
Dark Avenger II
Dark Avenger III
Datacrime
Datacrime II
Datacrime IIB
Datacrime-B
DataLock
DataLock 1.00
DBase
DBF Virus
Dead Kennedy
Death To Pascal
December 24th
Deicide
Den Zuk
Destructor
Destructor V4.00
Devil's Dance
Diamond
Diamond-B
Diana
Die Young Virus
Dir Virus
Discom
Disk Crunching Virus
Disk Killer
Disk Ogre
Do-Nothing Virus
Donald Duck
DOS-62
DOS-68
Durban
Dutch 555
Dyslexia
Dyslexia 2.00
Dyslexia 2.01
EB 21
Eddie
Eddie Virus
Eddie 3
EDV
Eight Tunes
Enigma
European Fish Viruses
Evil
Evil-B
F-Word Virus
Fall
Falling Letters
Falling Letters Boot
Father Christmas
Fellowship
Fish 6
Enigma
Crash
Crew-2480
Cascade
Cursy
Dark Avenger
Dark Avenger
V2000
V1024
Datacrime
Datacrime II
Datacrime IIB
Datacrime-B
DataLock
DataLock
DBase
DBase
Kennedy
Wisconsin
Icelandic-III
Deicide
Den Zuk
Destructor V4.00
Destructor V4.00
Devil's Dance
V1024
V1024
Dark Avenger
V2000
Dir Virus
Discom
Icelandic, Saratoga
Disk Killer
Disk Killer
Do-Nothing Virus
Stoned
Vienna
Vienna
Saturday The 14TH
Dutch 555
Solano 2000
Solano 2000
Solano 2000
Print Screen
Dark Avenger
Dark Avenger
V651
EDV
Eight Tunes
Enigma
Fish Virus
Evil
Evil
F-Word Virus
Cascade
Cascade, Ping Pong-B
Swap Boot
Father Christmas
Fellowship
Fish Virus
Fish Virus
Five O'Clock Virus
Flash
Flip
Flip B
Form
Form Boot
FORM-Virus
Frere Virus
Frere Jacques
Friday 13th
Friday 13th COM Virus
Friday 13th-B
Friday 13th-C
FroDo
Frog
Frog's Alley
Fu Manchu
Fuck You
Fumble
G-Virus V1.3
Ghost Boot
Ghost COM
Ghostballs
Glenn
Golden Gate
Grither
Green Left Virus
Groen Links
Guppy
Guppy-B
Hahaha
Halloechen
Hammelburg
Happy Birthday Joshi
Happy N.Y.
Happy New Year
Happy New Year
Hawaii
Hebrew University
Hemp Virus
HIV
HM2
Holland Girl
Holland Girl 2
Holo
Holocaust
Hybrid
Hybryd
Hymn
Hymn-2
Icelandic
Icelandic-II
Icelandic-III
Ick
IDF Virus
IKV 528
Internal
Invader
Iraqui
Fish Virus
Yankee Doodle
Flash
Flip
Flip
FORM-Virus
FORM-Virus
FORM-Virus
Frere Jacques
Frere Jacques
Jerusalem
Friday The 13th COM Virus
Friday The 13th COM Virus
Friday The 13th COM Virus
4096
Frog's Alley
Frog's Alley
Fu Manchu
F-Word
Typo COM
Sorry
Ghostballs
Ghostballs
Ghostballs
Deicide
Golden Gate
Grither
Groen Links
Groen Links
Guppy
Guppy
AIDS
Halloechen
405
Joshi
Happy New Year, Happy New Year B
Happy New Year
Happy New Year B
Stoned
Jerusalem B
Stoned
HIV
Plastique
Holland Girl
Holland Girl 2
Holocaust
Holocaust
Hybryd
Hybryd
Hymn
Sverdlov
Icelandic
Icelandic-II
Icelandic-III
IKV 528
4096
IKV 528
1381 Virus
Invader
Iraqui Warrior
Iraqui Warrior
Israeli
Israeli Boot
Italian
Italian 803
Italian 803-B
Italian-A
Itavir
Jeff
Jerk
Jerusalem
Jerusalem A
Jerusalem B
Jerusalem C
Jerusalem D
Jerusalem DC
Jerusalem E
Jerusalem E2
Jocker
JoJo
JoJo 2
Joker
Joshi
July 13TH
June 16TH
Kamasya
Kamikazi
Kemerovo
Kemerovo
Kennedy
Keypress
Korea
Kukac
Lazy
LBC Boot
Leapfrog
Lehigh
Lehigh University
Lehigh-2
Lehigh-B
Leprosy
Leprosy 1.00
Leprosy-B
Liberty
Liberty-B
Liberty-C
Lisbon
Little Pieces
Live after Death Virus
Lozinsky
Mardi Bros
Marijuana
Mazatlan
Merritt
Mendoza
Mexican
MG
MG-2
MG-3
MGTU
Iraqui Warrior
Jerusalem, Suriv 1.01, Suriv 2.01, Suriv 3.00
Swap
Ping Pong
Italian 803
Italian 803
Ping Pong, Ping Pong B
Itavir
Jeff
Jerk
Jerusalem
Jerusalem
Jerusalem B
Jerusalem B
Jerusalem B
Jerusalem B
Jerusalem B
Jerusalem B
Joker
JoJo
JoJo 2
Joker
Joshi
July 13TH
June 16TH
Kamasya
Kamikazi
Kemerovo
Kemerovo-B
Kennedy
Keypress
Korea
Turbo Kukac
Lazy
Korea
USSR 516
Lehigh
Lehigh
Lehigh
Lehigh
Leprosy
Leprosy
Leprosy
Liberty
Liberty
Liberty
Lisbon
Little Pieces
V800
Lozinsky
Mardi Bros
Stoned
Golden Gate
Alameda
Jerusalem B
Devil's Dance
MG
MG-2
MG-2
MGTU
Miami
Microbes
Migram
Minnow
Mirror
Mistake
MIX1
MIX2
MIX/1
Mix1
Mix2
Monxla
Monxla B
Mother Fish
Munich
Murphy
Murphy-1
Murphy-2
Music Boot
Music Bug
Music Virus
MusicBug
Musician
New Jerusalem
New Zealand
News Flash
Nina
Nomenclature
Nomenklatura
Number 1
Number of the Beast
Number One
Ogre
Ohio
One In Eight
One In Ten
One In Two
Ontario
Oropax
Oulu
P1
Pakistani
Pakistani Brain
Palette
Paris
Parity
Park ESS
Payday
Peking
Pentagon
Perfume
Phantom
Phoenix
PhoenixD
Ping Pong
Ping Pong-B
Ping Pong-C
Pixel
Pixel 2
Plastique
Plastique 1
Plastique 2
Plastique 4.51
Plastique 5.21
Plastique Boot
Plastique-B
PLO
Point Killer
Polimer
Polimer Tapeworm
Polish 217
Polish 217 B
Polish 529
Polish 583
Polish 961
Polish Stupid
Polish-2
Pray
Pretoria
Print Screen
Print Screen-2
Proud
PRTSC Virus
Prudents Virus
PSQR Virus
Puerto
RaubKopie
Red Diavolyata
RedX
Rigor Mortis
Rostov
RPVS
RPVS-B
Russian
S-847
Saddam
San Diego
Saturday The 14th
Saratoga
Saratoga 2
Scott's Valley
Seoul
Sentinel
Sex Revolution v1.1
Sex Revolution v2.0
SF Virus
Shake Virus
Shoe_Virus
Shoe_Virus-B
Skism-1
Slayer
Slayer Family
Slayer-A
Slayer-B
Slayer-C
Slayer-D
Slayer-E
Slow
Slowdown
Smithsonian
Plastique
Plastique-B
Plastique
Plastique-B
Invader
Plastique-B
Jerusalem
Dot Killer
Polimer
Polimer
Polish 217
Polish 217
Polish 529
Polish 583
Stone`90
Polish 217
Turbo 448, Turbo Kukac
ZK900
June 16TH
Print Screen
Print Screen
Proud
Print Screen
1210
1720
Jerusalem B
RaubKopie
Red Diavolyata
Ambulance Car
Arf
Stoned
RPVS
RPVS
Jerusalem
Amstrad
Saddam
Stoned
Saturday The 14th
Saratoga
Icelandic
Scott's Valley
Alameda
Sentinel
Stoned
Stoned
SF Virus
Shake Virus
Ashar
Ashar-B
Jerusalem B
Slayer Family
Slayer Family
Slayer Family
Slayer Family
Slayer Family
Slayer Family
Slayer Family
Slow
Slow
Stoned
Solano 2000
Solomon
Sorry
South African
Sparse
Spyer
Staf
Staff
StarDot
StarDot 600
StarDot 801
Stealth Viruses
Solano 2000
1605
Sorry
Friday The 13th COM Virus
Sparse
Spyer
Staf
Staf
StarDot 600, StarDot 801
StarDot 600
StarDot 801
EDV, Fish, Holocaust, Joshi, Murphy, V651, V800, V1024,
V2000, V2100, ZeroHunt, 512, 4096
Stone`90
Stone-90
Stoned
Stoned II
Stoned-B
Stoned-C
Stoned-D
Stoned-E
Stoned-F
Striker #1
Stupid Virus
Subliminal 1.10
Sunday
Sunday-B
Sunday-C
Suomi
SuperHacker
Suriv 1.01
Suriv 2.01
Suriv 3.00
Suriv A
Suriv B
Suriv01
Suriv02
Suriv03
SVC V4.00
Sverdlov
Sverdlov-B
SVir
SVir_0
SVir-A
SVir-B
Swap
Swedish Disaster
Swiss 143
Swiss 1813
Sylvia
Sylvia 2
SysLock
System Virus
Taiwan
Taiwan 2
Taiwan 3
Taiwan 4
Taiwan-B
Talentless Jerk
Stone`90
Stone`90
Stoned
Stoned
Stoned
Stoned
Stoned
Stoned
Stoned
Striker #1
Do-Nothing
Subliminal 1.10
Sunday
Sunday
Sunday
1008
Jerk
Suriv 1.01
Suriv 2.01
Suriv 3.00
Suriv 1.01, Suriv 2.01
Suriv 3.00
Suriv 1.01
Suriv 2.01
Suriv 3.00
USSR 1689
Sverdlov
Sverdlov
SVir
SVir
SVir
SVir
Swap
Swedish Disaster
Swiss 143
Jerusalem B
Holland Girl
Holland Girl 2
Syslock
Icelandic-II
Taiwan
Taiwan
Taiwan 3
Taiwan 4
Taiwan
Jerk
Tannenbaum
Taunt
Tel Aviv
Ten Bytes
Tester
TestVir
The Plague
Thor
Time
Time B
Tiny Family
Tiny Virus
Tiny 134 Virus
Tiny 138 Virus
Tiny 143 Virus
Tiny 154 Virus
Tiny 156 Virus
Tiny 158 Virus
Tiny 159 Virus
Tiny 160 Virus
Tiny 163 Virus
Tiny 169 Virus
Tiny 198 Virus
Toothless Virus
TP04VIR Virus
TP05VIR Virus
TP06VIR Virus
TP16VIR Virus
TP23VIR Virus
TP24VIR Virus
TP25VIR Virus
TP33VIR Virus
TP34VIR Virus
TP38VIR Virus
TP41VIR Virus
TP42VIR Virus
TP44VIR Virus
TP45VIR Virus
TP46VIR Virus
Traceback
Traceback II
Traceback II-B
Traceback-B
Traceback-B2
Travel Virus
Turbo @
Turbo 448
Turbo Kukac
Turbo Kukac 9.9
Typo Boot
Typo COM
UIUC Virus
UIUC Virus-B
Unesco
UScan Virus
USSR
USSR 257
USSR 311
USSR 394
USSR 492
Christmas Virus
AIDS
1605
1554
Tester
Tester
The Plague
Arf
Monxla
Monxla B
Tiny Family
Tiny Virus
Tiny Family
Tiny Family
Tiny Family
Tiny Family
Tiny Family
Tiny Family
Tiny Family
Tiny Family
Tiny Virus
Tiny Family
Tiny Family
W13
Vacsina
Vacsina
Vacsina
Vacsina
Vacsina
Vacsina
Vacsina
Yankee Doodle
Yankee Doodle
Yankee Doodle
Yankee Doodle
Yankee Doodle
Yankee Doodle
Yankee Doodle
Yankee Doodle
Traceback
Traceback II
Traceback II
Traceback
Traceback
V2000
Turbo 448
Turbo 448
Turbo Kukac
Turbo Kukac
Typo Boot
Typo COM
Ashar
Ashar
Vienna
V2100
USSR
Kemerovo
USSR 311
Attention!
USSR 492
USSR 516
USSR 600
USSR 707
USSR 711
USSR 830
USSR 948
USSR 1049
USSR 1689
USSR 2144
V-1
V-277
V-299
V-311
V-345
V-847
V-847B
V-852
V-Alert
V605
V651
V791
V800
V800M
V801
V920
V1024
V1226
V1226D
V1226M
V1277
V1302
V1521
V1600
V1701New
V1701New-B
V2000
V2000-B
V2100
V2P1
V2P2
V2P6
V2P6-B
V2P6Z
Vacsina
VBasic Virus
Vcomm
Vera Cruz
VFSI
VGA2CGA
VHP
VHP2
VHP-348
VHP-353
VHP-367
VHP-435
VHP-623
VHP-627
Victor
Vien6
Vienna
USSR 516
USSR 600
USSR 707
USSR 711
Red Diavolyata
USSR 948
USSR 1049
USSR 1689
USSR 2144
1253
Amstrad
Amstrad
USSR 311
Amstrad
Amstrad
Amstrad
Amstrad
1554
Anti-Pascal
V651
V801
V800
V800
V801
DataLock
V1024
1226
1226D
1226D
Murphy
Proud
Murphy
Happy New Year
Evil
Evil
V2000
V2000
V2100
1260
V2P2
V2P6
V2P6
V2P6Z
Vacsina
5120
Vcomm
Ping Pong
VFSI
AIDS
VHP
VHP2
VHP
VHP
VHP
VHP
VHP2
VHP2
Victor
Vienna
Vienna
Vienna C
646
Vienna-B
Vienna
Vienna-B 645
Vienna
Violator
Violator
Violator B4
Violator B4
Violator Strain B
Violator
Violator Strain B4
Violator B4
VirDem
VirDem
VirDem 2
VirDem
Virus-90
Virus-90
Virus-B
Friday The 13th COM Virus
Virus101
Virus101
Voronezh
Voronezh
Voronezh B
Voronezh
VP
VP
W13
W13
W13-A
W13
W13-B
W13
Westwood
Westwood
Whale
Whale
Wisconsin
Wisconsin
Wolfman
Wolfman
Wolfman 2
Wolfman
XA1
Christmas Tree
Xmas In Japan
Christmas In Japan
Yale
Alameda
Yankee 2
Yankee 2
Yankee Doodle
Yankee Doodle
Yankee Doodle Dropper Slayer Family
Yankee Virus
Yankee 2
Yankee-go-Home
Yankee 2
Yap
Yap
Yukon Overwriting
Yukon Overwriting
Z The Whale
Whale
Zero Bug
Zero Bug
ZeroHunt
ZeroHunt
ZeroHunt B
ZeroHunt
ZK900
ZK900
------------------------------------------------------------------------------Virus Information Summary List
Virus Relationship Chart
512 Virus
--> 512-B
--> 512-E
--> 512-F
--> 512-C
834
--> 834-B/Arab
1226
--> 1226M
--> 1226D
4096
--> 4096-B
--> Fish
--> 4096-C
--> Whale
Alameda
--> Alameda-2
--> Golden Gate --> Golden Gate-B --> Golden Gate-C
--> SF Virus
Anti-Pascal
--> AP-529
--> AP-400
--> 512-D
--> AP-440
--> AP-480
Note: AP-480, AP-440, and AP-400 are grouped together in the listing
as Anti-Pascal II
Blood
--> Blood2
Brain
-->
-->
-->
-->
Cascade/1701
--> 1701-B
--> 1704
Ashar
Clone
Chaos
EDV
-->
-->
-->
-->
1704 Format
1704-B
17Y4
Cunning
Datacrime
--> Datacrime-B
--> Datacrime II --> Datacrime IIB
Do-Nothing
--> Saddam
--:
--> Plastique
--:
Holland Girl
Icelandic
--> Saratoga
--> Iceland II -->
-->
--> Mix1
-->
-->
Icelandic III
Dec 24th
Mix1-B
Mix2
JoJo
--> JoJo 2
Kemerovo
--> Kemerovo-B
Kennedy
Leprosy
--> Leprosy-B
MG
--> MG-2
--> MG-3
Murphy-1
-->
-->
-->
-->
-->
Ohio
Perfume
--> Sorry
Phoenix
--> PhoenixD
Murphy-2
AntiChrist
HIV
Kamasya
Migram
--> Evil-B
Ping Pong
-->
-->
-->
-->
-->
Pixel
--> Amstrad
--> Evil
--> V-345
--> S-847
-->
-->
-->
-->
V-847B
V-852
V-299
Pixel 2
--> V-277
Polish 217
Stoned
--> Stoned-B
-->
-->
-->
-->
-->
-->
-->
-->
Suriv 3.00
--> Jerusalem
Sverdlov
--> Sverdlov-B
Syslock
--> Macho
--> Advent
--> Cookie
Tiny-198
--> Tiny-167
--> Tiny-160
--> Tiny-159
--> Tiny-158
--> Tiny-156
--> Tiny-154
--> Tiny-143
Rostov
Sex Revolution v1.1 --> Sex Revolution v2.0
Stoned-C
Stoned-D
Stoned-E
Stoned-F
Stoned II
Swedish Disaster
--> Macho-B
--> Tiny-138
--> Tiny-134
--> Tiny-133
Note: The Tiny-nnn Viruses indicated above are grouped together in
the listing as "Tiny Family". The Tiny-163 virus is not
related to the above group of viruses.
Traceback II
V1024
Vienna
-->
-->
-->
-->
Father Christmas
Lisbon
Ghostballs
1260
--> V2P2
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
W13/V-534 -->
Wien (Poland)
Vien6
Vienna-B
-->
Violator
-->
Grither
VHP-348
-->
VHP-623
-->
Iraqui Warrior
Arf
--> V800M
--> V2000-B
--> V2100
--> Casper
--> V2P6
--> V2P6Z
W13-B/V-507
Vienna-B 645
Violator B4
VHP-353
VHP-627
--> VHP-367
--> VHP-435
--> Virus101
Wolfman
--> Wolfman 2
Yankee 2
--> Enigma
ZeroHunt
--> ZeroHunt B
- Pixel 2 Variant
- S-847 Variant
Enigma
- Reference to Yankee 2
Friday The 13th COM
- Virus B Alias Added
Guppy
- Guppy-B Variant
Mix1
- Reference to Mix2
Murphy
- References to AntiChrist, HIV, Kamasya, Migram
Ping Pong B
- Italian-A Alias Added
Sverdlov
- Hymn-2 Alias Added
- Sverdlov-B Variant
SVir
- SVir_0 Variant
V1024
- Diamond Alias Added
- Diamond Variant
- Diamond-B Variant
V2P6
- V2P6-B Variant
Yankee 2
- Reference to Enigma
The following new viruses have been added to the listing:
AntiChrist
Casino
Crash/1075
Frog's Alley
HIV
Italian 803
- Italian 803
- Italian 803-B
Kamasya
Migram
Mix2
Raubkopie
Slayer Family - Slayer-A
- Slayer-B
- Slayer-C
- Slayer-D
- Slayer-E
Sparse
Staf
StarDot 600
StarDot 801
Tester/TestVir
V801/V791
Yap Virus
ZK900/Pray
Information for the following anti-viral products has been added or
updated:
NAV
- Norton AntiVirus, Version 1.00
ViruScan - updated for version V76
17 March, 1991 - VSUM9103.ZIP
The following virus descriptions have been updated, or new variants
added:
1575
- 1575-C Variant
1605
- 1605-B/Solomon Variant
Jerusalem B
- Captain Trips Variant
- Swiss 1813 Variant
Kemerovo
- Kemerovo-B Variant
Vienna
- Description Updated
Wolfman
- Wolfman 2 Variant
ZeroHunt
- ZeroHunt B Variant
The following new viruses have been added to the listing:
834 Virus
Arf Virus
Australian 403
Azusa
Crew-2480
Deicide
Dutch 555
Enigma
Jerk
Lazy
Phantom
Striker #1
Information for the following anti-viral products has been added or
updated:
Clean-Up - updated for version V75
ViruScan - updated for version V75
14 February, 1991 - VSUM9102.ZIP
The following virus descriptions have been updated, or new variants
added:
4096
- 4096-C Variant
Aids
- Aids B Variant
Flip
- Flip B Variant
Liberty
- Clarificiation to entry, change to Liberty B
identification string for use with Scan.
- Liberty B Variant
Paris
- Update to description
Plastique
- Plastique COBOL Variant
Polish 217
- Polish 217 B Variant
Stoned
- rewrote entry & merged in Stoned II entry
- Rostov Variant
- Sex Revolution v1.1 Variant
- Sex Revolution v2.0 Variant
- Stoned E Variant
- Stoned F Variant
USSR 1689
- Added SVC V4.00 alias
The following new viruses have been added to the listing:
903
1575
- 1575 Virus
- 1575-B Variant
4870 Overwriting
Akuku
Cookie
Destructor V4.00
Dir Virus
Discom
Grither
Happy New Year
- Happy New Year
- Happy New Year B Variant
Holland Girl 2
Hybryd
IKV 528
Iraqui Warrior
JoJo 2
Little Pieces/1374
MG
MG-2
- MG-2
- MG-3 Variant
Monxla B
Nina
Parity
Saddam
Sentinel
Swedish Disaster
Swiss 143
The Plague
USSR 311
USSR 492
Violator B4
Yukon Overwriting
Information for the following anti-viral products has been added
or updated:
Pro-Scan - additional disinfection updates for version 2.01
Clean-Up - updated for version V74
ViruScan - updated for version V74
08 January, 1991 - VSUM9101.ZIP
The following virus descriptions have been updated, or new variants
added:
4096
- additional information added
Flip
- additional information added
Invader
- correction to Type Code
Jerusalem B - Skism-1 Variant
Nomenklatura - additional damage information added
Plastique
- additional information, activation data
Plastique B - additional information, activation data
Tiny Family - Tiny 133 Variant
The following new viruses have been added to the listing:
Attention!
Best Wishes - Best Wishes
- Best Wishes B
Bloody!
F-Word Virus
Holocaust
Hymn
Jeff
Kemerovo
Lozinsky
MGTU
MusicBug
Polish 583
Red Diavolyata
Stone`90/Polish 961
Sverdlov
USSR 516
USSR 600
USSR 707
USSR 711
USSR 948
USSR 1049
USSR 1689
USSR 2144
Voronezh
- Voronezh
- Voronezh B
ZeroHunt
Information for the following anti-viral products has been added or
updated:
Clean-Up - updated for version V72
Pro-Scan - updated for version 2.01
ViruScan - updated for version V72
CleanUp
- McAfee Associates' CleanUp Disinfector, Version V67
AVTK
- Dr. Solomon's Anti-Viral Toolkit, Version 3.5
F-Prot
- Fridrik Skulason's F-Prot, Version 1.12
VirexPC
- MicroCom's Virex PC, Version 1.10B
ViruScan
- McAfee Associates' ViruScan Detector, Version V67
[Note: For ViruScan, as of version V67, any viruses which now
require the /X command line parameter to be used have been
indicated under Detection Method.]
The following viruses have not been added to the listing at this time
for the reason indicated:
Big Italian - No Sample Available
TP43Vir
- Sample does not replicate.
Doom2
- Unable to get samples to replicate.
10 August, 1990 - VSUM9008.ZIP
The following virus descriptions have been updated, or new variants
added:
1720
- Activation information added
Anti-Pascal - Anti-Pascal 529/AP-529 Variant
Sunday
- Sunday-B Variant
- Sunday-C Variant
Tiny Virus - previously in VSUM9007 as 163 COM Virus
Traceback - Traceback-B Variant
- Traceback-B2 Variant
Traceback II
- Traceback II-B Variant
V800
- V800M Variant
Vienna
- Vienna-B 645 Variant
The following new viruses have been added to the listing:
382 Recovery Virus
1226
- 1226 Virus
1226D
- 1226D Variant
- 1226M Variant
1253/V-1
AirCop
Anthrax
Anti-Pascal II
- Anti-Pascal 400/AP-400
- Anti-Pascal 440/AP-440
- Anti-Pascal 480/AP-480
Fellowship
Flip
Leprosy
Mardi Bros
Ontario
Phoenix/P1
PhoenixD/P1
Plastique - HM2
- Plastique
- Plastique 4.51
Plastique-B - Plastique 5.21
RPVS/453
- RPVS
- RPVS-B Variant
TCC
Tiny Family - Tiny 158 Virus
- Tiny 159 Virus
- Tiny 160 Virus
- Tiny 167 Virus
- Tiny 198 Virus
V1701New/P1 - V1701New
- 512-C Variant
- 512-D Variant
1554 Virus
4096
- 4096-B Variant
Amstrad
- Pixel/V-345 Variant
- V-277 Variant
- V-299 Variant
- V-847 Variant
- V-847B Variant
Jerusalem B - A-204 Variant
- Anarkia Variant
- Anarkia-B Variant
- Mendoza Variant
Ping Pong-B - Ping Pong-C Variant
Solano 2000 - Dyslexia 2.01 Variant
V2000
- V2000-B/Die Young Variant
Vacsina
- TP04VIR Variant
- TP05VIR Variant
- TP06VIR Variant
- TP16VIR Variant
- TP23VIR Variant
- TP24VIR Variant
- TP25VIR Variant
Yankee Doodle
- TP33VIR Variant
- TP34VIR Variant
- TP38VIR Variant
- TP41VIR Variant
- TP42VIR Variant
- TP44VIR Variant
- TP45VIR Variant
- TP46VIR Variant
Vienna
- VHP-435
- VHP-623
The Vienna-B variant has been moved under the Vienna entry.
The following new viruses were added to the listing:
5120
Eight Tunes
Fish Virus
Frere Jacques
JoJo
Liberty
Murphy
- 2 variants (Murphy-1 and Murphy-2)
Shake Virus
Slow
Subliminal 1.10
V800
Victor
VirDem
VP
Yankee 2
4 May, 1990 - VSUM9005.ZIP (Not publicly distributed.)
Added listings for Discovered, Symptoms, Origin, Subdivided
memory-resident classes, Aligned data entry blocks, placed files
in ASCII order, placed revision history in descending order.
Information on the following virii was updated:
1168/Datacrime
1280/Datacrime
Kennedy