Simulati Virus

Virus Name: Simulati Aliases: V Status: Rare Discovered: June, 1991 Symptoms: .COM file growth; message; system hang; file date/time changes Origin: Unknown Eff Length: 1,257 - 1,313 bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Simulati virus was submitted in June, 1991. Its origin is unknown. Simulati is a non-resident, direct action infector of .COM programs. It does not infect COMMAND.COM. When a program infected with Simulati is executed, the virus will search the current directory for an uninfected .COM program. If one is found, the virus will infect it. Infected .COM programs increase in length by 1,257 to 1,313 bytes with the virus being located at the end of the infected file. The program's date and time in the disk directory will also have been updated to the current system date and time. On a random basis, the Simulati virus will display a message and then hang the system. The message will be one of the following three: "ALIVE... Your system is infected by the SIMULATION virus. Have a nice day!" "FRODO LIVES!" "HA HA HA YOU HAVE A VIRUS" These messages, when they are displayed, are centered vertically and horizontally on the system display.