Surrender Virus

Virus Name: Surrender Aliases: V Status: Rare Discovered: January, 1992 Symptoms: .COM & .EXE growth; Interrupt 21 hooked Origin: Unknown Eff Length: 513 Bytes Type Code: PRaAK - Parasitic Resident .COM & .EXE Infector Detection Method: Sweep, ViruScan, F-Prot, AVTK, PCScan, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Surrender virus was submitted in January, 1992, and has an unknown origin. Surrender is a memory resident infector of .COM and .EXE programs. It will infect COMMAND.COM if it is executed. The first time a program infected with the Surrender virus is executed, this virus will install itself memory resident in the DOS buffers and graphics card memory. There will be no change to total system and available free memory as indicated by the DOS CHKDSK program. Interrupt 21 will be hooked directly by the virus in memory. Once Surrender is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 513 bytes with the virus being located at the end of the infected file. There will be no change to the file's date and time in the DOS disk directory listing. The following text strings appear in the Surrender viral code in all infected programs: "Jet" "Jews NEVER surrender!" Surrender doesn't appear to do anything besides replicate.