Saturday The 14TH Virus

Virus Name: Saturday The 14TH Aliases: Durban, Saturday 14th V Status: Rare Discovered: March, 1990 Symptoms: TSR;.COM, .EXE, .OV? growth; corrupts boot sector, FAT & master boot sector on Saturday 14th Origin: Republic of South Africa Eff Length: 669 Bytes Type Code: PRA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, NAV, F-Prot, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, NShld Removal Instructions: Delete infected files General Comments: The first reports of the Saturday The 14TH virus came from South Africa in March 1990. The Saturday The 14TH, or Durban virus, is a memory resident generic file infector, infecting COM, .EXE, and overlay files, but not COMMAND.COM. Infected files will increase in length by between 669 and 684 bytes. The Saturday The 14TH virus activates on any Saturday that falls on the 14TH of any month, at which time it will overwrite the first 100 logical sectors of the C: drive, B: drive, and A: drive. In effect, on drive C:, the virus destroys the hard disk boot sector, master boot sector, and file allocation table (FAT).