Skid Row Virus

Virus Name: Skid Row Aliases: Skid Row.418 V Status: New Discovered: January, 1995 Symptoms: .EXE files altered Origin: Unknown Eff Length: 418 Bytes Type Code: PRE - Overwriting Resident .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, ViruScan, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, AVTK/N, IBMAV/N, NShld, Sweep/N, LProt, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Skid Row virus was received in January, 1995. Its origin or point of isolation is unknown. Skid Row is a memory resident infector of .EXE programs. It is a fast infecting stealth virus, quickly spreading on infected systems. When the first Skid Row infected program is executed, this virus will install itself memory resident, tunnelling the interrupts it uses. Memory mapping utilities will not show any interrupts to be assigned to the virus in memory. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. Once the Skid Row virus is memory resident, it will infect .EXE programs when they are executed or opened for any reason. Infected programs will have 418 of the first 512 bytes in the file overwritten with the viral code. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code in infected programs. The Skid Row virus is a full stealth virus, and the virus will disinfect infected programs when they are read into memory. It is unknown if Skid Row does anything besides replicate. Known variant(s) of Skid Row are: Skid Row.415: Also received in January, 1995, Skid Row.415 is a 415 byte variant of the Skid Row virus described above. It becomes memory resident in available system memory, hooking interrupt 13. Infected programs will have the 415 of the first 512 bytes of the host file overwritten by the viral code. Origin: Unknown January, 1995. Skid Row.432: Also received in January, 1995, Skid Row.432 is a 432 byte variant of the Skid Row virus described above. Frequent system hangs occur on infected systems. Origin: Unknown January, 1995.