Violetta Virus

Virus Name: Violetta Aliases: V Status: Common - Germany Discovered: January, 1992 Symptoms: .COM file growth; TSR Origin: Germany Eff Length: 3,840 - 7,678 Bytes Type Code: PRsC - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, ChAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Violetta virus was discovered in Germany in January, 1992. It was reported to be widespread in Germany at the time of its isolation. Violetta is a memory resident infector of .COM files, but does not infect COMMAND.COM. The first time a program infected with Violetta is executed, the Violetta virus will install itself memory resident as a low system memory TSR of 8,256 Bytes. Interrupts 21, CC, CE, F1, F7, and F8 will be hooked. Once the Violetta virus is memory resident, it will infect .COM programs when they are executed. Programs infected with the Violetta virus will normally have a file length increase of 3,840 bytes. However, if the program's pre-infection file length was less than 3,840 bytes, the program's infected file length will be 7,680 bytes. In either case the virus will be located at the beginning of the infected program. There will be no change to the file's date and time in the DOS disk directory listing. The following text strings will appear within the viral code in Violetta infected programs: "VIOLETTA" "Version 4.00" It is unknown if Violetta does anything besides replicate. Known variant(s) of Violetta are: Violetta-1024: Violetta-1024 is a smaller version of the Violetta virus. Its memory resident TSR is 4,432 bytes in length, and hooks interrupt 21. Violetta- 1024 infects .COM programs when they are executed. Infected .COM programs will have a file length increase of 1,024 bytes with the virus being located at the beginning of the file. .COM programs which were originally smaller than 1,024 bytes in length will become 2,048 bytes in length when infected by Violetta-1024. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings can be found within the viral code in Violetta-1024 infected programs: "Greetings to Cracker Jack..." "Loving thoughts to Shirley..." "Marty McFly lives somewhere in time." "Kill Eddie. Kill Diana. Kill Fredo." Origin: Unknown June, 1992