Voronezh-370 Virus

Virus Name: Voronezh-370 Aliases: 370-B V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; TSR; file date/time change Origin: Unknown Eff Length: 370 Bytes Type Code: PRsCK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, NAVDX, NAV, IBMAV, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Voronezh-370 virus was received in November, 1991 from Europe. Its origin is unknown. Voronezh-370 is a memory resident infector of .COM programs. It does not infect COMMAND.COM. The first time a program infected with Voronezh-370 is executed, this virus will install itself memory resident as a low system memory TSR of 1,712 bytes. It will have hooked interrupt 21. Once Voronezh-370 is memory resident, it will infect .COM programs other than COMMAND.COM when they are executed. Infected programs will have a file size increase of 370 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory will have been updated to the current system date and time when infection occurred. It is unknown if Voronezh-370 does anything besides replicate. See: Voronezh Voronezh-Chemist