TechnoRat Virus

Virus Name: TechnoRat Aliases: Rat-615 V Status: New Discovered: March, 1993 Symptoms: .COM file growth; file date/time seconds set to "62" Origin: USSR Eff Length: 615 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: Sweep, AVTK, F-Prot, IBMAV, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, AVTK/N, NAV/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The TechnoRat, or Rat-615, virus was submitted in March, 1993. It appears to be from the USSR. TechnoRat is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the TechnoRat virus is executed, this virus will infect all of the .COM programs located in the current directory, and the directory directly above the current directory. Infected programs will have a file length increase of 615 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, however the seconds field will have been set to "62". The following text strings are visible within the TechnoRat viral code in all infected files: "Techno-Rat I. Copyright by Lord Blaise, Odessa 1991." "???????????" "COM" "????????COM" "*.* *.COM ..\*.COM" It is unknown what TechnoRat may do besides replicate.