Tankard Virus

Virus Name: Tankard Aliases: Tankard V2.0 V Status: New Discovered: March, 1993. Symptoms: .COM file growth; decrease in total system & available free memory Origin: Unknown Eff Length: 493 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, IBMAV, PCScan, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Tankard, or Tankard V2.0, virus was submitted in March, 1993. Its origin or point of isolation is unknown. Tankard is a memory resident, fast infector of .COM programs, including COMMAND.COM. When the first Tankard infected program is executed, the Tankard virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Interrupt 12's return will not be moved. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,024 bytes. Once the Tankard virus is memory resident, it will infect .COM programs when they are executed or opened for any reason. Infected programs will have a file length increase of 493 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the Tankard viral code in all infected programs: "IBMBIO.COM IBMDOS.COM" "Tankard vers.2.0" It is unknown what Tankard may do besides replicate. Known variant(s) of Tankard are: Tankard V3.01: A 556 byte variant of the Tankard virus, this variant's size in memory is also 1,024 bytes, hooking interrupt 21. It adds 556 bytes to the .COM programs it infects on execution and open. The following text strings can be found within the Tankard V3.0 viral code in infected programs: "IBMBIO.COM IBMDOS.COM" "Tankard vers. 3.01" Origin: Unknown March, 1993.