Slovak Virus


 Virus Name:  Slovak 
 Aliases:     Slovak 2.00, Slovakia 
 V Status:    Rare 
 Discovered:  May, 1992 
 Symptoms:    .EXE file growth; message displayed 
 Origin:      Czechoslovakia 
 Eff Length:  1,673 - 1,771 Bytes 
 Type Code:   PNE - Parasitic Non-Resident .EXE Infector 
 Detection Method:  AVTK, ViruScan, F-Prot, IBMAV, Sweep, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Slovak, Slovak 2.00 or Slovakia, virus was discovered in 
       Czechoslovakia in May, 1992.  During May, 1992, a total of four 
       different viruses were isolated in the Slovak family.  Slovak 2.00 
       will be described in this entry, with the other initial viruses 
       listed below under variants.  All of the viruses in this group are 
       non-resident polymorphic viruses. 
 
       When a program infected with the Slovak 2.00 virus is executed, the 
       may infect one .EXE program located in the current directory, though 
       it does not always infect files.  The only time the virus will 
       always infect an .EXE program is when the directory where the 
       program being executed is not the current directory, and is on the 
       system path.  At this time, the virus will then infect one .EXE 
       program in the current directory. 
 
       Programs infected with the Slovak 2.00 virus will have a file length 
       increase of 1,673 to 1,771 bytes with the virus being located at the 
       end of the infected file.  As with all of the Slovak viruses, the 
       Slovak 2.00 virus is encrypted, and no text strings are visible 
       within the viral code in infected programs.  The file's date and time 
       in the DOS disk directory listing will not be altered. 
 
       Occassionally when a Slovak 2.00 infected program is executed, the 
       virus will display approximately the following message requiring the 
       user to type in the word "SLOVAK": 
 
       "SLOVAKIA virus version 2.00  (c) 1991 by ??. All Rights Reserved. 
 
        Greetings from Bratislava, SLOVAKIA. 
        Type the word SLOVAKIA:" 
 
        If the user starts to type a word other than SLOVAKIA, the virus 
        will display the following message, which is then cleared after 
        the user presses escape as requested: 
 
        "Type the word SLOVAKIA, not CZECH, YUGOSLAVIA, or SLOVENIA!! 
         Press Esc." 
 
        Once the user types the word SLOVAKIA, the program the user was 
        attempting to execute will run. 
 
        One other text string is encrypted within the viral code: 
       
               "PATH=*.EXE" 
 
        Slovak 2.00 doesn't appear to do anything besides replicate and 
        display its message requiring a user response. 
 
        Known variant(s) of Slovak are: 
        Slovak 1.00: An earlier variant of Slovak, this variant infects 
                .COM files instead of .EXE programs, adding 1,352 to 1,603 
                bytes to the end of the files it infects.  The message 
                displayed is much simplier, still requiring that the user 
                type the word SLOVAKIA: 
                "Greeting from Bratislava, SLOVAKIA. 
                 Type the word SLOVAKIA:" 
                Origin: Czechoslovakia  May, 1992. 
        Slovak 2.02: A later version of Slovak 2.00, this variant 
                infects .EXE programs, adding 1,969 to 2,091 bytes to the 
                .EXE programs it infects.  The message displayed by the 
                virus is similar to Slovak 2.00, with the exception that 
                the version number indicated will be 2.02. 
                Origin: Czechoslovakia  May, 1992. 
        Slovak 3.00: A later version of Slovak 2.02, this variant 
                also infects .EXE programs.  Infected files will have a 
                file length increase of 2,051 to 2,177 bytes with the 
                virus being located at the end of the file.  The message 
                displayed is similar to Slovak 2.02, with the exception 
                that the version number is now 3.00. 
                Origin: Czechoslovakia  May, 1992. 
        Slovak-4: An earlier variant of Slovak, this variant is very 
                similar to the Slovak 1.00 variant described above, though 
                it does not display any message.  Infected files will have 
                a file length increase of 1,363 to 1,587 bytes with the 
                virus being located at the end of the file.  It is only 
                slighly polymorphic. 
                Origin: Czechoslovakia  November, 1992. 
        Slovak-4B: A later version of the Slovak-4 variant, Slovak-4B 
                infects one .EXE program each time an infected program is 
                executed.  Infected files will have a file length increase 
                of 2,586 to 2,810 bytes with the virus being located at the 
                end of the file.  The program's date and time in the DOS 
                disk directory listing will not be altered.  The following 
                message will sometimes be displayed, requiring the user to 
                type the word "Slovakia": 
                "SLOVAKIA virus version 4.00 (c) 1991 - 1992 by ??" 
                "ALL Rights Reserved." 
                "Greetings from Bratislava, SLOVAKIA." 
                "Type the word SLOVAKIA:........" 
                Typing the word Slovakia will result in the user being 
                returned to the DOS prompt. 
                Origin: Czechoslovakia  May, 1993.

Show viruses from discovered during that infect .

Main Page