Zero Bug Virus

Virus Name: Zero Bug Aliases: Palette, 1536, Zero V Status: Endangered Discovered: September, 1989 Symptoms: .COM growth (see text); TSR; graphics display Origin: Netherlands Eff Length: 1,536 bytes Type Code: PRsC - Parasitic Resident .COM Infector Detection Method: Viruscan, F-Prot, AVTK, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, or delete infected files General Comments: The Zero Bug virus was first isolated in the Netherlands by Jan Terpstra in September, 1989. This virus is a memory resident .COM file infector. Infected .COM files will increase in size by 1,536 bytes, however the increase in file length will not show up when the disk directory is displayed. The virus's main objective is to infect the copy of COMMAND.COM indicated by the environment variable COMSPEC. If COMSPEC doesn't point to anything, the Zero Bug virus will install itself memory resident using INT 21h. After the virus has either infected COMMAND.COM or become memory resident, it will infect all .COM files that are accessed, including those accessed by actions such as COPY or XCOPY. Any .COM file created on an infected system will also be infected. If the currently loaded COMMAND.COM is infected, the virus will hook into the timer interrupt 1Ch, and after a certain amount of time has past, a smiley face character ( ) will appear and eat all the zeros it can find on the screen. The virus does not delete files or format disks in its present form. Known variant(s) of Zero Bug are: Zero Bug B: Similar to Zero Bug, this variant will not infect the copy of COMMAND.COM pointed to by the COMSPEC environment variable when the first infected file is executed. Zero Bug B will only infect .COM files when they are copied. The Zero Bug B virus' TSR is 1,840 bytes in size and hooks interrupts 21 and 60.