Tiso Virus

Virus Name: Tiso Aliases: V Status: New Discovery: August, 1993 Symptoms: .COM file growth; decrease in total system & available free memory Origin: Italy Eff Length: 846 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, NAV, PCScan, NAVDX, VAlert, ChAV, AVTK/N, Sweep/N, NShld, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Tiso virus was received in August, 1993, and is originally from Italy. Tiso is a memory resident infector of .COM programs, including COMMAND.COM. When the first Tiso infected program is executed, the Tiso virus will infect the copy of COMMAND.COM located in the C: drive root directory. It does not become memory resident until later when the system is booted from the system hard disk and the infected COMMAND.COM. When Tiso is memory resident, it will resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,024 bytes. Interrupts 08 and 24 will be hooked by Tiso in memory. Once the Tiso virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 846 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code in Tiso infected programs. It is unknown what Tiso does besides replicate. Known variant(s) of Tiso are: Tiso.1279: Received in May, 1994, Tiso.1279 is a 1,279 byte variant of the Tiso virus described above. Unlike the original virus, this variant is multi-partite, infecting the system hard disk master boot sector (partition table sector), in addition to .COM and .EXE files. When the first infected program is executed, the virus will infect the system hard disk master boot sector. The virus does not become memory resident, however, until the system is booted from the infected system hard disk. The virus's size in memory is 2,048 bytes at the top of system memory, but below the 640K DOS boundary. Interrupt 12's return will be moved, and interrupt 21 will be hooked by the virus in memory. Once the virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 1,279 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code. It is unknown what this variant does besides replicate. Origin: Italy May, 1994.