TSoft Virus

Virus Name: TSoft Aliases: TSoft-547, TurboSoft, TurboSoft-547 V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth; file time seconds set to "62"; hard disk corruption Origin: Poland Eff Length: 547 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, IBMAV, ViruScan, Sweep, AVTK, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The TSoft, or TurboSoft, virus was submitted in December, 1992. It is originally from Poland. TSoft is a non-resident, direct action infector of .COM programs, including COMMAND.COM. It is based on the Vienna virus. When a program infected with the TSoft virus is executed, the TSoft virus will infect one .COM program located in the current directory. Infected programs will have a file length increase of 547 bytes with the virus being located at the end of the file. The program's file date and time in the DOS disk directory listing will appear to not be altered, though the seconds field in the file time will have been set to "62". The following text strings can be found within the viral code in all TSoft infected programs: "\????????.COM" "????????COM" "TurboSoftware" TSoft contains code to overwrite a portion of the system hard disk. Known variant(s) of TSoft are: TSoft-598: A 598 byte variant of the TSoft virus, this variant infects one .COM program in the current directory each time an infected program is executed. Infected programs will have a file length increase of 598 bytes. The seconds field in the file time in the DOS disk directory will be set to "62". The following text strings can be found within the viral code in all TSoft-598 infected programs: "\????????.COM" "????????COM" "\dos" "T.Software -Death 1.0" TSoft-598 contains code to overwrite a portion of the system hard disk. Origin: Poland December, 1992. See: Vienna