Bandit Virus

Virus Name: Bandit Aliases: V Status: Research Discovery: May, 1991 Symptoms: .EXE file growth Origin: Italy Eff Length: 1,641 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Bandit virus was submitted in May, 1991. Bandit is originally from Italy. It is a non-resident direct action infector of .EXE programs. When a program infected with Bandit is executed, Bandit will search the current drive and directory for an uninfected .EXE program to infect. If an uninfected .EXE program is found, it will become infected. Bandit infected .EXE programs will increase in size by 1,641 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory will not be altered. Programs infected with Bandit will contain the following text strings, the second of which is located at the end of infected files: "*.* *.exe wwZZZZ" "!!PCBANDIT!!" Bandit is based on the Enigma virus and appears to be a research virus. See: Enigma