WWT Virus


 Virus Name:  WWT 
 Aliases:     WWT 01, WWT 02, WWT 02B 
 V Status:    Viron 
 Discovered:  May, 1991 
 Symptoms:    .COM program corruption 
 Origin:      Europe 
 Eff Length:  67 or 125 bytes 
 Type Code:   ONCK - Overwriting Non-Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The WWT viruses were received from Europe in May, 1991.  As of May, 
       1991, there are two viruses in this family.  One virus, WWT 01, is a 
       67 byte virus.  The other virus, WWT 02, is a 125 byte virus. 
       Both viruses are non-resident overwriting viruses which infect .COM 
       programs including COMMAND.COM. 
 
       When a program infected with a WWT virus is executed, the virus will 
       infect all .COM programs in the current directory.  If COMMAND.COM 
       resides in the current directory, it will be infected. 
 
       Infected programs will have the beginning portion of their code 
       overwritten with the viral code.  The number of bytes overwritten 
       depends on which of the WWT viruses are present.  The program's 
       date and time in the disk directory may also be updated to the 
       current system date and time. 
 
       Programs infected with a WWT virus will not execute properly since 
       they have been permanently corrupted due to the beginning of their 
       code having been overwritten. 
 
       WWT does not do anything besides replicate. 
 
       Known variant(s) of WWT are: 
       WWT 01: The WWT 01 variant is 67 bytes in length.  Programs 
               infected by this variant will have the first 67 bytes 
               overwritten by the virus.  If the program's original 
               length was less than 67 bytes, the infected program's 
               length will become 67 bytes.  Programs which are 67 bytes 
               or greater before infection will have no file length 
               increase.  WWT 01 infections will also result in the 
               .COM program's date and time in the disk directory having 
               been altered to the system date and time of infection. 
       WWT 02: The WWT 02 variant is 125 bytes in length.  Programs 
               infected by this variant will have the first 125 bytes 
               overwritten by the virus.  If the program's original 
               length was less than 125 bytes, the infected program's 
               length will become 125 bytes.  Programs which are 125 
               bytes or greater before infection will have no file 
               length increase.  WWT 02 infections will not result in 
               a change to the file's date and time in the disk 
               directory. 
       WWT 02B: WWT 02B is very similar to the WWT 02 variant. Its 
               only difference is that this variant has one byte which 
               has been altered at offset 2C. 
               Origin:  Unknown  January, 1992. 

Show viruses from discovered during that infect .

Main Page