Wild Thing 2 Virus

Virus Name: Wild Thing 2 Aliases: IVP.Wild_Thing V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth; display switched to 40 column mode & message displayed Origin: North America Eff Length: 567 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, IBMAV, NAV, NAVDX, Sweep, VAlert, ChAV, NShld, NProt, AVTK/N, Sweep/N, IBMAV/N, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Wild Thing 2 virus was submitted in December, 1992 and is from North America. It is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Wild Thing 2 virus is executed, this virus will infect all of the .COM programs located in the current directory. Infected programs will have a file length increase of 567 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "Wild Thing ][" "It's Friday... Enjoy the weekend with" "your computer! [YAM '92]" "By: Admiral Bailey [YAM]*.com \command.com" The Wild Thing 2 virus activates on Fridays, at which time execution of an infected program will result in the system monitor being switched to 40 column mode and the following message being displayed: "It's Friday... Enjoy the weekend with your computer! [YAM '92]" Known variant(s) of Wild Thing 2 are: Wild Thing: An earlier version of the Wild Thing 2 virus, Wild Thing was received in October 1992. The sample submitted does not replicate, and is not used for certification purposes. It contains the following text: "This is a Wild Thing" "LEGALIZE MARIJUANA!" "ACiD RULEZ!!! hahaha" "Programed by Magic" "*.com" Origin: North America, October, 1992. Wild Thing-289: A later version of the non-functional Wild Thing variant, Wild Thing-289 infects three .COM programs in the current directory each time an infected program is executed. Infected programs will have a file length increase of 289 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. It contains the following text: "This is a Wild Thing" "Programmed By Admiral Bailey [YAM]" "(C) 1992 YAM Inc." "*.com" The first three text strings above will be displayed as a message when an infected program is executed. Origin: North America, February, 1993. Wild Thing.555: Received in May, 1995, Wild Thing.555 is a 555 byte variant of the Wild Thing 2 virus described above. It infects all of the .COM files in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 555 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "Wild Thing ][" "It's Friday... Enjoy the weekend with" "your computer! [YAM '92]" "By: Admiral Bailey [YAM] *.com \command.com" Origin: Unknown May, 1995. Wild Thing.557: Received in May, 1995, Wild Thing.557 is a 557 byte variant of the Wild Thing 2 virus described above. It infects all of the .COM files in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 557 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "Wild Thing ][" "It's Friday... Enjoy the weekend with" "your computer! [YAM '92]" "By: Admiral Bailey [YAM] *.com \command.com" Origin: Unknown May, 1995. See: IVP