ZY Virus

Virus Name: ZY Aliases: V Status: Rare Discovered: July, 1992 Symptoms: .COM file growth; system hangs Origin: Austria Eff Length: 463 - 924 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: Sweep, ViruScan, IBMAV, F-Prot, AVTK, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The ZY virus was isolated in Austria in July, 1992. ZY is a non- resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the ZY virus is executed, this virus will infect one previously uninfected .COM program located in the current directory. Infected programs will usually increase in size by 463 bytes with the virus being located at the beginning of the infected file. The exception is that if the original program was smaller than 463 bytes, the program's length after infection will be 926 bytes. The file's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in ZY infected programs: "*.com * \ \ XSYS" Systems infected with ZY may experience system hangs when infected programs are executed. These hangs usually occur when COMMAND.COM becomes infected, or if the user attempts to executed a very small .COM file which has become infected.