Signs Virus

Virus Name: Signs Aliases: Signs of Life V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth; TSR Origin: Unknown Eff Length: 720 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan, NAVDX, NAV, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Signs, or Signs of Life, virus was submitted in December, 1992. Its origin or point of isolation is unknown. Signs is a memory resident infector of .COM programs, including COMMAND.COM. When the first Signs infected program is executed, the Signs virus will install itself memory resident as a low system memory TSR of 720 bytes. It will hook interrupt 21. Some memory mapping utilities may show the TSR as being an increase in the size of the "config" area in memory. Once the Signs virus is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 720 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in all Signs infected programs: "Signs Of Life." It is unknown what Signs may do besides replicate.