Sayha Watpu Virus

Virus Name: Sayha Watpu Aliases: SW Error V2f V Status: Rare Discovered: September, 1993 Symptoms: .COM & .EXE growth; TSR Origin: Unknown Eff Length: 4,000 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, NAV, AVTK, IBMAV, Sweep, NAVDX, VAlert, PCScan, ChAV, NShld, NAV/N, Sweep/N, IBMAV/N, AVTK/N, NProt, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Sayha Watpu, or SW Error V2f, virus was submitted in September, 1993. Its origin or point of isolation is unknown. Sayha Watpu is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. It is a fast infector, quickly spreading on infected systems. When the first Sayha Watpu infected program is executed, this virus will install itself memory resident as a low system memory TSR of 9,824 bytes. Interrupts 16 and 21 will be hooked by the virus in memory. Once the Sayha Watpu virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed or opened for any reason. Infected programs will have a file length increase of 4,000 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within all Sayha Watpu infected programs: "SW Error V2f Sayha Watpu" It is unknown what Sayha Watpu may do besides replicate.