Reklama Virus

Virus Name: Reklama Aliases: Reklama.2723.A V Status: Rare Discovery: August, 1992 Symptoms: .COM file growth; TSR Origin: Poland Eff Length: 2,723 Bytes Type Code: PRsCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, IBMAV, AVTK, Sweep, F-Prot, NAV, PCScan, NAVDX, VAlert, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Reklama virus was submitted in August, 1992. It is originally from Poland. Reklama is a memory resident infector of .COM programs, including COMMAND.COM. When the first Reklama infected program is executed, the Reklama virus will install itself memory resident as a low system memory TSR of 2,736 bytes. It hooks interrupt 21. Once the Reklama virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 2,723 bytes. The virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all Reklama infected programs: "Przekaze tylko pewna informacje i juz mnie nie ma." "Wszystko jest OK." "A oto ta oczekiwana informacja:" "Ognisko Muzyczne F R A Z A we Wroclawiu uczy gry na :" "- pianinie," "- akordeonie," "- syntezatorach," "- gitarze," "- skrzypcach," "- uczy rowniez spiewu solowego." "Ognisko Muzyczne F R A Z A organizuje rowniez kursy" "CHWYTOW GITAROWYCH." "Juz po czterech miesiacach poznasz tajniki" "gry na gitarze badz syntezatorze." "I TY mozesz umiec grac na roznych instrumentach muzycznych." "Kontakt : Wroclaw, tel. 25-90-97" "Nacisnij dowolny klawisz abys mogl pracowac" "Jesli chcesz umiescic relame w programie samokopiujacym," "pisz do:" "Agencji Wydawniczej: skr. poczt. 1009, WROCLAW 3" "Wirusek reklamowy 1" It is unknown what Reklama does besides replicate. Known variant(s) of Reklama are: Reklama.2723.B: Received in January, 1996, this is a 2,723 byte variant of the Reklama virus described above. It is functionally similar, and contains the following text strings: "Maly wirusek reklamowy." "PRODENTAL" "Stomatologia, Protetyka-Ortodoncja" "NCMAIN EXE" "NCMAIN.EXE" "Stosujemy tworzywa i metody zachodnie" "(prowadzacy firme posiada 20 letni staz w USA w najnowoczesniejszej" "protetyce" "Zapraszamy codziennie, w niedziele bezplatne porady" "Wroclaw, ul,Kosciuszki 125" "(c)1991 MPG Corp. 1" Origin: Unknown January, 1996.