Yap Virus

Virus Name: Yap Aliases: V Status: Rare Discovered: March, 1991 Symptoms: .COM growth; TSR; "Bugs" may appear in screen; decrease in available free memory Origin: United States Eff Length: 6,258 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, NAV, F-Prot, Sweep, IBMAV, ChAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Yap virus was discovered in March, 1991, in the United States. Yap is a memory resident .COM file infector. It will infect COMMAND.COM. The first time a program infected with the Yap virus is executed, the virus will install itself memory resident as a low system memory TSR of 11,344 bytes. Interrupts 09 and 21 will be hooked by the virus. After Yap is memory resident, it will infect .COM programs as they are executed. If COMMAND.COM is executed, it will become infected. .COM Programs infected with Yap will increase in size by 6,258 bytes. The virus will be located at the end of infected programs. The file's date and time in the disk directory will not be altered. With the Yap virus memory resident, if the system user holds down the ALT key, or presses the ALT key and another key in combination, numerous graphic "bugs" will appear on the screen which will eat the contents of the system display. Pressing the ALT key, or ALT key combination, again will result in the system's display being restored. Yap is an encrypted virus, using encryption very similar to that employed by the Cascade virus and its variants.