Shield Virus

Virus Name: Shield Aliases: V Status: Rare Discovered: March, 1992 Symptoms: .COM file growth; hidden .COM files created; file date/time change; TSR; system hangs Origin: Unknown Eff Length: 5,152 Bytes (companion files), 127 Bytes .COM Type Code: PSRsA - Parasitic Spawning Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, Sweep, NAV, NAVDX, VAlert, PCScan, IBMAV, F-Prot, ChAV, NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Shield virus was received in March, 1992. Its origin is unknown. This virus is a memory resident spawning or companion virus which infects .EXE programs by creating corresponding .COM files. It also adds 127 bytes to .COM programs other than COMMAND.COM, though these files do not carry an active viral infection. The first time a program infected with Shield is executed, the Shield virus will install itself memory resident as a low system memory TSR of 5,456 bytes. Interrupt 21 will be hooked. Once the Shield virus is memory resident, it will create a hidden companion .COM file of 5,152 bytes for each .EXE program which is executed or opened. It will also add 127 bytes of code to each .COM program which is executed or opened. The 127 bytes of additional code is added to the end of .COM programs, and the file's date and time in the DOS disk directory listing will have been updated. The Shield virus is creates an active infection only in the companion, hidden .COM programs. System hangs may occur on infected systems.