Wonder Virus

Virus Name: Wonder Aliases: V Status: Viron Discovered: January, 1992 Symptoms: .EXE programs overwritten; programs fail to execute; system hangs; message Origin: Unknown Eff Length: 7,424 Bytes Type Code: ONE - Overwriting Non-Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, AVTK/N, IBMAV/N, NAV/N, NProt Removal Instructions: Delete infected files General Comments: The Wonder virus was received in January, 1992. Its origin or point of original isolation is unknown. Wonder is a non-resident, over- writing virus which infects .EXE programs. When a program infected with Wonder is executed, the Wonder virus will infect all .EXE programs located in the current directory. The infected .EXE programs will have their first 7,424 bytes overwritten with the Wonder virus. Unless the file's pre-infection length was less than 7,424 bytes, there will be no change in the file's length. Programs whose pre-infection length was smaller than 7,424 bytes will become 7,424 bytes in length. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. Programs infected with Wonder will frequently hang the system when they are executed. If the program is larger than 64K in size, it may instead result in an "Error in EXE file" message and the user being returned to the DOS prompt. Known variant(s) of Wonder are: Wonder-2: The Wonder-2 variant is a minor variant of the Wonder virus described above. It has been altered so that it doesn't infect .EXE files over 64K in size. As a result, the "Error in EXE file" message no longer occurs.