Tadpoles Virus
Virus Name: Tadpoles
Aliases: Tadpoles.2792
V Status: New
Discovered: February, 1995
Symptoms: .COM & .EXE growth; TSR
Origin: Philippines
Eff Length: 2,792 - 2,804 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, NAVDX, NAV, IBMAV, PCScan, AVTK 7.68+,
NShld, NAV/N, IBMAV/N, AVTK/N 7.68+
Removal Instructions: Delete infected files
General Comments:
The Tadpoles virus was received in February, 1995. It is from
Cebu City in the Philippines. Tadpoles is a memory resident
infector of .COM and .EXE files, including COMMAND.COM.
When the first Tadpoles infected program is executed, this virus
will install itself memory resident as a low system memory TSR
of 3,232 bytes. Interrupt 21 and 2F will be hooked by the virus in
memory.
Once the Tadpoles virus is memory resident, it will infect .COM and
.EXE files when they are executed. Infected .COM files will have
a file length increase of 2,792 bytes. .EXE files increase in size
by 2,792 to 2,804 bytes. In both cases, the virus will be located
at the end of the file. The program's date and time in the DOS
disk directory listing will not be altered. The following text
string is visible within the viral code in all Tadpoles infected
files:
"CCCv (w) CCC CompE... Hail U.C.!"
It is unknown what the Tadpoles virus does besides replicate.