Padded Virus

Virus Name: Padded Aliases: V Status: Rare Discovery: March, 1992 Symptoms: .COM file growth Origin: Unknown Eff Length: 1,589 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, LProt, Innoc, NProt, NShld, IBMAV/N, AVTK/N, NAV/N Removal Instructions: Delete infected files General Comments: The Padded virus was submitted in March, 1992. Its origin is unknown. Padded is a non-resident direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Padded virus is executed, the Padded virus will infect one .COM program in the current directory. If COMMAND.COM is located in this directory, it may become infected. Programs infected with the Padded virus will have a file length increase of 1,589 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will not be altered. There are several text strings which can be seen within the viral code in Padded infected programs: "\ ENU \TENNIS" "????????COM" "CHECKIT.LOG" "*.COM" "WHISTLE.SPL" "ETABLE1.GIF" "*.*" It is unknown what Padded may do besides replicate. Known variant(s) of Padded are: Padded-B: Functionally similar to the original virus, this variant was received in April, 1992. The text strings have been changed to: "\ ODS \ STRIP R" "????????COM" "*.COM" "DOS" "GODS" "VOCEAN.LHZ" "MRA.V2E CAR" "*.*" Origin: Unknown April, 1992 See: Generic Hominy