Orchid Virus

Virus Name: Orchid Aliases: Orchid.120 V Status: Viron Discovered: July, 1995 Symptoms: .COM file corruption; file date/time changes; program corruption Origin: Unknown Eff Length: 120 Bytes (Overwriting) Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: F-Prot, AVTK, VAlert, ViruScan, Sweep, NAV, NAVDX, IBMAV, PCScan, ChAV, AVTK/N, Sweep/N, NShld, NAV/N, IBMAV/N, NProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Orchid virus was received in July, 1995. It is a non-resident, direct action overwriting virus which infects the first .COM file located in the current directory. When a program infected with the Orchid virus is executed, this virus will infect the first .COM file in the current directory by overwriting the first 120 bytes of the host program. If COMMAND.COM is the first .COM file in the directory, it will become infected by the virus. As this virus is an overwriting virus, it permanently corrupts any program it infects, the first 120 bytes no being saved by the virus. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when the last infection of the file occurred. The following text string can be found starting in the sixth byte of all infected files: "EŭGD" Infected programs cannot be disinfected, and must be replaced with uninfected backup copies.