Wonderful Virus

Virus Name: Wonderful Aliases: V Status: Rare Discovered: January, 1992 Symptoms: .COM file growth; unexpected access to C: drive Origin: Unknown Eff Length: 1,338 - 2,602 Bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, IBMAV, NAV, F-Prot, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Wonderful virus was received in January, 1992. Its origin or point of original isolation is unknown. Wonderful is a non- resident, direct action infect of .COM files other than COMMAND.COM. It is a member of the Burger family of viruses, and is based specifically on the VirDem virus. When a program infected with Wonderful is executed, the virus will search the C: drive directory structure to locate the first uninfected .COM file which is not named COMMAND.COM. Once this file is found, the virus will infect it. Wonderful infected programs will normally have a file length increase of 1,336 bytes. However, if the .COM file's original length was less than 1,280 bytes, the infected file's length will become 2,616 bytes. Therefore, file length increases can be anywhere from 1,336 bytes to 2,614 bytes. In any case, the virus will be located at the beginning of the infected file. There will be no change to the file's date and time in the DOS disk directory listing. The following text strings can be found within the viral code in Wonderful infected files: "*.com *" "? ????????exe" "????????com" "*.*" "\V 4V2 A" "KILLER" "SOMETHING WONDERFUL" "HAS HAPPENED !!!" It is unknown if Wonderful does anything besides replicate. See: Burger VirDem VirDem-1542