Taiwan Virus

Virus Name: Taiwan Aliases: Taiwan 2, Taiwan-B, Doom I, Doom I-B V Status: Endangered Discovered: January, 1990 Symptoms: .COM growth; 8th day of any month corrupts boot, FAT, & Master boot sectors Origin: Taiwan Eff Length: 743 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, NAV, or delete infected files General Comments: The Taiwan virus was first isolated in January, 1990 in Taiwan, R.O.C. This virus infects .COM files, including COMMAND.COM, and does not install itself into system memory. Each time a program infected with the Taiwan virus is executed, the virus will attempt to infect up to three .COM files. The current default directory is not first infected, instead the virus will start its search for candidate files in the C: drive root directory. Once an uninfected .COM file is located, the virus infects the file by copying the viral code to the first 743 bytes of the file, the original first 743 bytes of the file is relocated to the end of the .COM file. A bug exists in this virus, if the uninfected .COM file is less than 743 bytes in length, the resulting infected .COM file will always be 1,486 bytes in length. This effect is due to the virus not checking to see if it read less than 743 bytes of the original file before infecting it. The Taiwan virus is destructive. On the 8th day of any month, when an infected program is run the virus will perform an absolute disk write for 160 sectors starting at logical sector 0 on the C: and D: drives. In effect, this logical write will result in the FATs and root directory being overwritten. Known variant(s) of Taiwan are: Doom I: The variant of Taiwan that is between Taiwan-B and Taiwan, Doom I adds 752 bytes to infected files with no change in the file's date and time in the DOS disk directory. Doom I will infect four .COM files on the C: drive when an infected program is executed. It does not reset the current drive and directory after infecting the files, so if the user was not currently using the C: drive as the current drive, they may notice the change. Due to a bug in the virus, when Doom I infects programs smaller than 752 bytes, the infected program's length will become 1,488 bytes. Doom I-B: Doom I-B is a later version of the Taiwan virus, and increases the size of infected files by 677 bytes. It will infect three .COM files located on the C: drive when an infected program is executed. The current drive and directory will be properly reset to the drive and directory the user was currently located in once the infection process is complete. Unlike other variants of Taiwan, this variant will not infect programs smaller than itself. Taiwan-B: Apparently an earlier version of the Taiwan virus, this variant will hang the system when infected files are executed, but after it has infected another file using the selection mechanism indicated for the Taiwan virus.