Attack Virus

Virus Name: Attack Aliases: Attack-1501, Cuban V Status: Rare Discovery: April, 1992 Symptoms: .COM file growth; TSR; "Not enough memory" errors Origin: Cuba Eff Length: 1,501 Bytes Type Code: PRsC - Parasitic Resident .COM Infector Detection Method: F-Prot, Sweep, ViruScan, AVTK, NAVDX, VAlert, IBMAV, NAV, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, LProt, NAV/N Removal Instructions: Delete infected files General Comments: The Attack, or Attack-1501, virus was received in April, 1992 from Cuba. This virus is a memory resident parasitic infector of .COM programs, but not COMMAND.COM. There is also an earlier version of the virus, described below, which is an overwriting virus. The first time a program infected with the Attack virus is executed, this virus will install itself memory resident as a low system memory TSR of 3,552 bytes. It hooks interrupts 13, 21, and F8. Once the Attack virus is memory resident, it will infect two .COM programs located in the current directory any time a program is executed or a DOS DIR command is performed. Programs infected with the Attack virus will typically have a file length increase of 1,501 bytes. The exception is that if the original .COM program was smaller than 1,173 bytes, the program once infected will have a length of 2,684 bytes. The file's date and time in the DOS disk directory listing will not be altered. The following text strings can be found in all Attack infected files: "The Terminator Attack Now" "????????COM" "*.COM COMMAND.COM ERROR IN DEBBUG" Systems infected with the Attack virus may notice that some programs will no longer function properly, resulting in a "Not enough memory" error message when they are executed. Known variant(s) of Attack are: Attack-918: An earlier version of the Attack virus, this variant installs a 1.2K TSR when it becomes memory resident. Once it is memory resident, it will infect two .COM programs located in the current directory whenever any program is executed or a DOS DIR command is performed. Infected programs will have the first 918 bytes of the host program overwritten by the Attack-918 viral code. Infected programs will fail to execute properly, and must be replaced from clean, uninfected backups. Origin: Cuba April, 1992.