WWT Virus
Virus Name: WWT
Aliases: WWT 01, WWT 02, WWT 02B
V Status: Viron
Discovered: May, 1991
Symptoms: .COM program corruption
Origin: Europe
Eff Length: 67 or 125 bytes
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The WWT viruses were received from Europe in May, 1991. As of May,
1991, there are two viruses in this family. One virus, WWT 01, is a
67 byte virus. The other virus, WWT 02, is a 125 byte virus.
Both viruses are non-resident overwriting viruses which infect .COM
programs including COMMAND.COM.
When a program infected with a WWT virus is executed, the virus will
infect all .COM programs in the current directory. If COMMAND.COM
resides in the current directory, it will be infected.
Infected programs will have the beginning portion of their code
overwritten with the viral code. The number of bytes overwritten
depends on which of the WWT viruses are present. The program's
date and time in the disk directory may also be updated to the
current system date and time.
Programs infected with a WWT virus will not execute properly since
they have been permanently corrupted due to the beginning of their
code having been overwritten.
WWT does not do anything besides replicate.
Known variant(s) of WWT are:
WWT 01: The WWT 01 variant is 67 bytes in length. Programs
infected by this variant will have the first 67 bytes
overwritten by the virus. If the program's original
length was less than 67 bytes, the infected program's
length will become 67 bytes. Programs which are 67 bytes
or greater before infection will have no file length
increase. WWT 01 infections will also result in the
.COM program's date and time in the disk directory having
been altered to the system date and time of infection.
WWT 02: The WWT 02 variant is 125 bytes in length. Programs
infected by this variant will have the first 125 bytes
overwritten by the virus. If the program's original
length was less than 125 bytes, the infected program's
length will become 125 bytes. Programs which are 125
bytes or greater before infection will have no file
length increase. WWT 02 infections will not result in
a change to the file's date and time in the disk
directory.
WWT 02B: WWT 02B is very similar to the WWT 02 variant. Its
only difference is that this variant has one byte which
has been altered at offset 2C.
Origin: Unknown January, 1992.