StinkFoot Virus

Virus Name: StinkFoot Aliases: Stink V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; system crashes on 8086/8088 based machines Origin: Republic of South Africa Eff Length: 1,254 Bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, NAV, ChAV, F-Prot, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The StinkFoot virus was discovered in the Republic of South Africa in in November, 1991. It is a non-resident, direct action infector of .COM files, and does not infect COMMAND.COM. When a program infected with StinkFoot is executed, the virus will search the current drive and directory for an uninfected .COM file to infect whose uninfected length is at least 1,000 bytes. If such a file is found, the virus will infect it. Programs infected with StinkFoot will have a file length increase of 1,254 bytes. 259 bytes of the virus will be located at the beginning of the infected file, with the remaining 995 bytes of viral code being at the end of the file. There will be no visible change in the file's date and time in a DOS directory listing. StinkFoot does not do anything besides replicate. It will not function properly on XT (8088-based) machines. Known variant(s) of StinkFoot are: StinkFoot-1273: Sometimes referred to as Stink 2, StinkFoot-1273 is another version of this virus. It adds 1,273 bytes to the .COM programs it infects, splitting the viral code between the beginning and the end of the file. Origin: Republic of South Africa June, 1992. StinkFoot-2B: A minor variant of the StinkFoot virus described above, this variant adds 1,254 bytes to the files it infects with the first infection. It will reinfect previously infected programs, adding an additional 1,273 bytes to the file. Origin: Unknown March, 1993.