Tiny Di Virus

Virus Name: Tiny Di Aliases: Tiny Di-94, Tiny Di-101, Tiny Di-108, Tiny Di-110, Di-94, Di-101, Di-108, Di-110 V Status: Rare Discovery: January, 1992 Symptoms: .COM file growth; file date/time change; boot failure; program corruption Origin: Unknown Eff Length: 94 - 110 Bytes (see below) Type Code: PNCK - Parasitic Non-resident .COM Infector Detection Method: Sweep, ViruScan, F-Prot, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Tiny Di, or Di, family of four viruses was received in January, 1992. Its origin is unknown. The viruses in this family are non- resident infectors of .COM programs including COMMAND.COM. Since these four viruses exhibit similar behavior, they will be described in general, with their differences indicated below under variants. When a program infected with a Tiny Di virus is executed, the virus will infect all .COM files located in the current directory. If COMMAND.COM is located in this directory, it will be infected as well. Programs infected with one of the Tiny Di viruses will have the virus located at the beginning of the infected file. The file length increase, and whether the file will later be reinfected, depends on which virus is present. In any case, the infected files will have had their file date and time in the DOS disk directory listing updated to the current system date and time when infection occurred. One text string can be found within the viral code within Tiny Di infected programs: "*.com" The Tiny Di viruses do not intentionally do anything besides replicate, although programs may fail to execute properly once they are infected. The system will also fail to boot if the boot drive's copy of COMMAND.COM becomes infected. Known members of the Tiny Di family are: Tiny Di-94: This virus adds 94 bytes to the .COM files it infects. It is unable to distinquish when a program has been previously infected, so it will reinfect previously infected .COM files. Each reinfection will also add 94 bytes. Tiny Di-101: A 101 byte member of the Tiny Di family, this virus infects all .COM files in the current directory, though not always in a parasitic manner. In some cases, the virus will overwrite the first 101 bytes of infected programs without saving the original first 101 bytes. Therefore, with the initial infection of a program, the file length increase will be either zero or 101 bytes. Like Tiny Di-94, it cannot recognize previously infected files, and will later reinfect them, adding an additional zero or 101 bytes. Tiny Di-108: Similar to Tiny Di-101, this virus is 108 bytes in length and will infect some programs in a parasitic manner, and others by overwriting the first 108 bytes. Unlike Tiny Di-101, it can recognize previously infected files, and does not reinfect them. Tiny Di-110: Similar to Tiny Di-108, this virus is 110 bytes in length.