V351 Virus

Virus Name: V351 Aliases: V-351 V Status: New Discovered: August, 1993 Symptoms: .COM file growth; programs fail to function properly; decrease in total system & available free memory Origin: Unknown Eff Length: 351 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, Sweep, F-Prot, IBMAV, NAVDX, VAlert, NAV, AVTK, ChAV, NShld, Sweep/N, IBMAV/N, NProt, NAV/N, AVTK/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The V351, or V-351, virus was received in August, 1993. Its origin or point of isolation is unknown. V351 is a memory resident infector of .COM programs, including COMMAND.COM. When the first V351 infected program is executed, the V351 virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21 at approximately address 7D00. Interrupt 12's return will not have been moved. Once the V351 virus is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 351 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. One text string is visible within the viral code in V351 infected programs: "*.COM" Once the V351 virus is memory resident, programs will fail to function properly when they are executed.