Beaches Virus

Virus Name: Beaches Aliases: V Status: Rare Discovery: June, 1993 Symptoms: .EXE file growth; Decrease in total system & available free memory Origin: The Netherlands Eff Length: 1,392 - 1,406 Bytes Type Code: PRtE - Parasitic Resident .EXE Infector Detection Method: ViruScan, Sweep, F-Prot, IBMAV, AVTK, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, Innoc, IBMAV/N, AVTK/N, NAV/N Removal Instructions: Delete infected files General Comments: The Beaches virus was submitted in June, 1993, and is from The Netherlands. Beaches is a memory resident infector of .EXE programs. The virus contains a poem, which is how it derives its name. When the first Beaches infected program is executed, the Beaches virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 4,912 bytes. No interrupts are directly mapped to the viral code in memory. The Beaches virus infects up to five .EXE programs in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 1,392 to 1,406 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Beaches viral code: "sandy beaches" "bridges sinking into the sea" "beautiful confusion" "you're a fading memory" "Disappearer3" "*.EXE \* \" It is unknown what Beaches does besides replicate.