Atomic 2 Virus
Virus Name: Atomic 2
Aliases: Atomic 2A
V Status: Rare
Discovery: May, 1993
Symptoms: .COM file growth; "Program execution terminated" message;
programs fail to function properly
Origin: Canada
Eff Length: 350 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, Sweep, ViruScan, IBMAV, NAV, NAVDX,
VAlert, PCScan, ChAV,
NShld, AVTK/N, Sweep/N, NProt, NAV/N, IBMAV/N, Innoc,
LProt
Removal Instructions: Delete infected files
General Comments:
The Atomic 2, or Atomic 2A, virus was submitted in May, 1993, and
is from Canada. Atomic 2 is a non-resident, direct action parasitic
virus. Programs infected with Atomic 2 will not function properly.
When a program infected with the Atomic 2 virus is executed, the
Atomic 2 virus will infect one .COM file located in the current
directory, and then the following message will be displayed:
"Program execution terminated"
The user is then returned to the DOS prompt.
Programs infected with the Atomic 2 virus will have a file length
increase of 350 bytes with the virus being located at the end of
the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text strings are visible
within the viral code in all Atomic 2 infected programs:
"*.COM [TAD2A] Created by Memory Lapse of Ontario, CANADA"
"[TAD2A] The Atomic Dustbin 2A -- Just Shake Your Rump!"
"Fail on INT 24 .. NOT!!"
"*.COM .."
Known variant(s) of Atomic 2 are:
Atomic 2B: A 831 byte variant of the virus described above, it
infects the one .COM file in the current directory when
an infected program is executed, and then displays
one of the following messages:
"Unable to infect program"
"Fail on INT 21"
It may also infect a copy of COMMAND.COM located in the
route directory of the current drive, even though this is
not the current directory. Atomic 2B will not infect
.COM files located after the first five .COM files in any
directory. Infected files increase in size by 831 bytes
with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing
will have been updated to the current system date and
time when infection occurred. The following text strings
are visible within the viral code in all Atomic 2B
infected programs:
"*.COM \COMMAND.COM \DOS\COMMAND.COM"
"Copyright (c) 1993 Memory Lapse - Ontario, Canada"
"[TAD2B]-The-Atomic-Dustbin-2B"
"Unable to infect program"
"Fail on INT 21"
"The Atomic Dustbin 2B - I'm Here To Stay"
"????????COM"
Origin: Canada May, 1993.
Atomic.166: Received in July, 1994, Atomic.166 is a 166 byte
variant of the Atomic 2 virus. It infects one .COM file
in the current directory when an infected program is
executed. Infected programs will have a file length
increase of 166 bytes with the virus being located at the
end of the file. The program's date and time in the DOS
disk directory listing will not be altered. One text
string is visible within the viral code:
"*.COM"
Origin: Unknown July, 1994.
Atomic.967: A 967 byte variant of the virus described above, it
infects the one .COM file in the current directory when
an infected program is executed, and then a system hang
may occur. Infected files increase in size by 967 bytes
with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing
will not be altered. The following text strings are
visible within the viral code in all infected programs:
"*.COM"
"PATH="
"I'm not working until Howard Stern is done @ 11:00 am !"
"Bow down before the King"
"Smile ... [NuKE] loves you"
"I'm not working until Howard Stern is done @ 11:00 am !"
"()ascii (c) Ba Ba Stupid..."
"Remember Studderin' John"
"Robin, I love You!"
"Long Live [NuKE]"
"Georgia needs Howard Stern"
Origin: United States October, 1994.
See: Atomic 1