Unsnared Virus

Virus Name: Unsnared Aliases: Unsnared.814 V Status: In the wild Discovered: July, 1996 Symptoms: .EXE file growth; file date/time minutes = "13"; system hangs; decrease in total system & available free memory Origin: Unknown Eff Length: 814 Bytes Type Code: PRtE - Parasitic Resident .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, ViruScan, PCScan, NAV, NAVDX, ChAV, Innoc, AVTK/N, IBMAV/N, NShld, NAV/N Removal Instructions: Delete infected Files General Comments: The Unsnared virus was received in July, 1996 and has been reported to be "in the wild". Its origin or point of isolation is unknown. Unsnared is a memory resident infector of .EXE files. When the first Unsnared infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 1,024 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Unsnared virus is memory resident, it will infect .EXE files when they are executed. Infected files will have a file length increase of 814 bytes with the virus being located at the end of the file. The program's date in the DOS disk directory listing will not be altered, but the minutes field in the time will have been set to "13". No text strings are visible within the viral code. System hangs frequently occur on infected systems when .EXE files are executed.