QMU Virus

Virus Name: QMU Aliases: QQ-1513 V Status: Rare Discovery: November, 1991 Symptoms: .COM file growth; master boot sector altered; file date/time changes; TSR or decrease in total system memory Origin: Unknown Eff Length: 1,513 Bytes Type Code: PRsCKX - Parasitic Resident .COM & Master Boot Sector Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, LProt, IBMAV/N Removal Instructions: Delete infected files, MDisk /P General Comments: The QMU virus was submitted in November, 1991. QMU is a memory resident infector of the hard disk master boot sector (partition table) as well as .COM programs, including COMMAND.COM. Its origin is unknown. When the first QMU infected program is executed on a system, QMU will become memory resident as a low system memory TSR of 2,080 bytes. The TSR will have hooked interrupts 13 and 21. At this time, QMU will also infect the hard disk master boot sector, moving the original master boot sector to the second side 0, cylinder 0, sector 2, and writing a full copy of the virus starting in sector 3. If the system is later booted from the infected hard disk, the virus will become memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 5,120 bytes. Interrupts 13 and 21 will be hooked. Interrupt 12's return will have been moved. Once QMU is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 1,513 bytes. The virus will be located at the end of infected files. The infected program's date and time in the DOS disk directory will have been updated to the current system date and time when infection occurred. Text strings found in infected files include the boot sector error messages normally found in the boot sector, along with the following string: "Bad command or file name" It is unknown what QMU does besides replicate.