Viking Virus

Virus Name: Viking Aliases: Viking.Dec3 V Status: New Discovered: February, 1995 Symptoms: .COM & .EXE growth; TSR; system hangs Origin: Unknown Eff Length: 1,350 - 1,566 Bytes (Approx) Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, ViruScan, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Innoc, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Viking or Viking.Dec3 virus was received in February, 1995. Its origin or point of isolation is unknown. Viking is a memory resident infector of .COM and .EXE files, including COMMAND.COM. When the first Viking infected program is executed, the Viking virus will install itself memory resident as a low system memory TSR of 5,136 bytes. Interrupt 21 will be hooked by the virus in memory. The boot copy of COMMAND.COM will become infected by the virus if it was not previously infected. A system hang may occur at this time if the virus is attempting to become memory resident from other than the boot copy of COMMAND.COM. Once the Viking virus is memory resident, it will infect .COM and .EXE files when they are executed, opened, or a DOS Dir command is issued. Infected files will have a file length increase of 1,350 to 1,566 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "*.COM *.EXE Dec 3 92 is my 20th birthday (V6)" It is unknown what the Viking virus does besides replicate.