Shifter Virus


 Virus Name:  Shifter 
 Aliases:    
 V Status:    Rare 
 Discovered:  February, 1993 
 Symptoms:    .EXE file growth; Master Boot Sector Altered; decrease in 
              total system & available free memory 
 Origin:      Unknown 
 Eff Length:  6,672 Bytes 
 Type Code:   PRtEX - Parasitic Resident .EXE & Master Boot Sector Infector 
 Detection Method:  AVTK, Sweep, ViruScan, NAV, IBMAV, NAVDX, 
                    F-Prot, VAlert, PCScan, ChAV, 
                    LProt, Sweep/N, NShld, AVTK/N, NAV/N, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files & Replace Master Boot Sector 
 
 General Comments: 
       The Shifter virus was submitted in February, 1993.  Its origin or 
       point of isolation is unknown.  Shifter is a memory resident infector 
       of the hard disk master boot sector (partition table sector) and 
       .EXE programs. 
 
       When the first Shifter infected program is executed, the Shifter 
       virus will infect the system hard disk's master boot sector, the 
       sector containing the hard disk partitioning information.  The virus 
       does not become memory resident at this time, and will not start 
       infecting files. 
 
       The next time the system is booted from the system hard disk, the 
       Shifter virus will become memory resident at the top of system 
       memory but below the 640K DOS boundary, moving interrupt 12's 
       return.  Total system and available free memory, as indicated by the 
       DOS CHKDSK program, will have decreased by 7,168 bytes. 
 
       Once the Shifter virus is memory resident, it will infect .EXE 
       programs when they are executed.  Infected programs will have a file 
       length increase of 6,672 bytes with the virus being located at the 
       end of the file.  The file's date and time in the DOS disk directory 
       listing will not be altered.  No text strings are visible within the 
       Shifter viral code. 
 
       It is unknown what Shifter does besides replicate. 

Show viruses from discovered during that infect .

Main Page