Zaphod Virus

Virus Name: Zaphod Aliases: V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth; file date/time changes; message Origin: England Eff Length: 399 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAVDX, IBMAV, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, LProt, NProt, IBMAV/N, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Zaphod virus was submitted in December, 1992. Zaphod is a non-resident, direct action infector of .COM programs, including COMMAND.COM. It is from England. When a program infected with the Zaphod virus is executed, the Zaphod virus will infect the first .COM program located in the current directory. It does not infect .COM programs located further down the directory. Programs infected with the Zaphod virus will have a file length increase of 399 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. The Zaphod virus activates on February 28th of any year. On this date, execution of an infected program will result in the following message being displayed: "Greetings from ZAPHOD." Besides the above message, the following text strings are also encrypted within the viral code: "Lu*.COM" "????????COM" Zaphod doesn't do anything besides display its message and replicate.