Attention! Virus

Virus Name: Attention! Aliases: USSR 394, USSR-394, 394 V Status: Rare Discovery: December, 1990 Symptoms: .COM file growth; decrease in system and available memory; clicking emitted from system speaker on keypress; file date/time changes Origin: USSR Eff Length: 394 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Attention! virus was submitted in December, 1990 and was originally isolated in the USSR. This virus is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with the Attention! virus is executed, the virus will reserve 416 bytes at the top of system memory, but below the 640K DOS boundary. The virus becomes memory resident in this area, and hooks interrupt 21. Total system memory and available free memory returned by the DOS CHKDSK command will decrease by 416 bytes. The interrupt 12 return is not moved. After the virus is memory resident, a clicking sound will be emitted by the system speaker each time a key is pressed on the keyboard. Some programs, such as the EDLIN program supplied with MS-DOS, will receive an "Invalid drive or file name" message when they are attempted to be executed. Attention! will infect .COM files, including COMMAND.COM, when they are executed. The exception is that very small .COM files will not become infected. Infected files will increase in length by 394 bytes with the virus being located at the end of the file. Infected programs will also contain the text string: "ATTENTION !" near the beginning of the program.