Small-38 Virus

Virus Name: Small-38 Aliases: V Status: Viron Discovered: December, 1991 Symptoms: program and data file corruption; file date/time changes; programs fail to execute properly; system hangs Origin: Canada Eff Length: 38 Bytes Type Code: ONAK - Overwriting Non-Resident Program & Data File Infector Detection Method: F-Prot, ViruScan, AVTK, NAV, NAVDX, VAlert, PCScan, IBMAV 2.41D+, NShld, AVTK/N, NAV/N, LProt, IBMAV/N 2.41D+ Removal Instructions: Delete infected files General Comments: The Small-38 virus was received in December, 1991 from Wallace Hale of Canada. Source code from Mr. Hale was received with this virus, and indicates that he wrote it in response to the Mini-45 virus in May, 1991. This virus is not believed to be in the public domain, and is considered a research virus. It is a non-resident, direct action infector of program and data files. When a program infected with Small-38 is executed, the virus will infect all files located in the current directory. The virus does not care if the file is an executable program or a data file. It will infect any file it encounters. Infected programs will have the first 38 bytes overwritten with the viral code. There will be no file length increase unless the file's original length was less than 38 bytes, in which case the file's length becomes 38 bytes. The file's date and time in the DOS disk directory will have been updated to the system date and time when infection occurred. Once Small-38 has finished infecting all the files in the current directory, the system will be hung in a search loop on the current directory. The system will need to be rebooted to get out of the loop. Program and data files infected with Small-38 are permanently damaged, having had the first 38 bytes overwritten. They should be replaced with a clean backup copy.