Turbo Virus

Virus Name: Turbo Aliases: Turbo 448, @ Virus, Turbo @, Polish-2, Nagytud V Status: Rare Discovered: November, 1990 Symptoms: .COM growth; "File not found" errors with some utilities Origin: Hungary Eff Length: 448 Bytes Type Code: PRCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Turbo, or Turbo 448, virus was discovered in Hungary in November, 1990. This virus is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with the Turbo virus is executed, the virus will install itself memory resident at the end of the Command Interpreter in memory. Total system memory and available free memory will not decrease. Interrupt 21 will be hooked by the virus. The Turbo virus is unusual in that it does not infect programs when they are executed. Instead, it infects .COM files when they are opened for some other reason besides execution. For example, if the virus is memory resident a program A.COM is copied to B.COM, both programs will become infected by the virus. Infected files will increase in length by 448 bytes, with the virus being located at the end of the file. The program's date and time in the disk directory will also have been updated to the system date and time when the file was infected. The following text string can be found at the end of all infected programs: "Udv minden nagytudasunak! Turbo @" Another interesting behavior of this virus is that when the virus is memory resident, anti-viral products which are unaware of the Turbo 448's presence in memory will not function properly. After the third file is read, the program may fail due to a "file not found" error being received when it attempts to open the fourth program. Known variant(s) of Turbo are: Turbo Kukac: Discovered in Hungary in November, 1990, this virus is a memory resident infector of .COM programs, including COMMAND.COM. It installs itself memory resident following the command interpreter and any previously loaded TSRs, decreasing total system and available free memory by 1,040 bytes. Interrupts 05 and 21 are hooked by the virus. Turbo Kukac infects .COM programs when they are opened for a reason other than execution. Infected programs will increase in size by 512 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will have been updated. The following text string can be found in all infected programs: "Turbo Kukac 9.9" Origin: Hungary November, 1990.