Aragorn Virus

Virus Name: Aragorn Aliases: V Status: Rare Discovery: March, 1993 Symptoms: .COM & .EXE growth; write protect errors; message Origin: Italy Eff Length: 1,522 - 1,537 Bytes Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, NAV/N, AVTK/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Aragorn virus was submitted in March, 1993, and is originally from Italy. Aragorn is a non-resident, direct action infector of .COM and .EXE programs, including COMMAND.COM. It displays an Ansi graphics message on its activation on October 28th of any year. When a program infected with the Aragorn virus is executed, this virus will infect one .COM file and one .EXE program located in the current directory. Due to a bug in the virus, once Aragorn infects the first .EXE file in the directory, it will not infect other .EXE programs within the directory. This same bug doesn't occur with .COM programs. Programs infected with the Aragorn virus will have a file length increase of 1,522 to 1,537 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Aragorn infected files: "(C)1992 Aragorn-Rome" "*.com *.exe" "RRRR" The last text string occurs at the very end of infected files. The Aragorn virus activates when an infected program is executed on October 28th of any year, at which time it will display the following message in Ansi text. The indicated {color bar} is a representation of the Italian flag: "MUSSOLINI DUX 28 OTTOBRE ANNIVERSARIO MARCIA SU ROMA { color bar } BOIA CHI MOLLA" The text for this message is not visible within infected programs.