Timor Virus

Virus Name: Timor Aliases: V Status: Rare Discovery: April, 1992 Symptoms: .COM & .EXE file growth; TSR; message displayed on November 12th Origin: Unknown Eff Length: 1,562 - 1,576 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, Sweep, ViruScan, IBMAV, PCScan, AVTK, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Timor virus was received in April, 1992. Its origin is unknown. Timor is a memory resident infector of .COM and .EXE programs, and is based on the Jerusalem virus. When the first Timor infector program is executed, the Timor virus will install itself memory resident as a low system memory TSR of 2,816 bytes. It will hook interrupts 21 and F8. Once Timor is memory resident, it will infect .COM and .EXE programs when they are executed. .COM programs will have a file length increase of 1,562 bytes with the virus being located at the beginning of the infected file. .EXE programs will have a file length increase of 1,562 - 1,576 bytes with the virus being located at the end of the infected file. Unlike Jerusalem, Timor does not reinfect .EXE files. Infected programs will not have any change to their date and time in the DOS disk directory. The following text strings can be found in all Timor infected programs: "Timor" "St Cruz, Dili" "COMMAND.COM" "LxTimor" "sso, Freedom for East Timor !" "1991 Nov 12, Lusitƒia Expres" Timor activates on November 12th of any year, at which time it may display the message: "St Cruz, Dili". See: Jerusalem