Bebe Virus

Virus Name: Bebe Aliases: V Status: Rare Discovery: December, 1990 Symptoms: .COM file growth; long disk access on .COM program execution; clicking on system speaker and system hang Origin: USSR Eff Length: 1,000 - 1,019 Bytes Type Code: PRCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N, NShld Removal Instructions: Delete infected files General Comments: The Bebe virus was received from the USSR in December, 1990. Bebe is a memory resident virus, though it replicates as a direct action .COM program infector. When a program infected with Bebe is executed, Bebe will search and infect all previously uninfected .COM programs on the current drive and directory. If COMMAND.COM resides in the current directory, it will become infected. Programs infected with Bebe increase in size by 1,000 to 1,019 bytes with the virus being located at the end of the infected file. The infected programs will also have had their date and time in the DOS disk directory updated to the current system date and time when infection occurred. Since Bebe searchs the current directory, and infects all .COM programs not previously infected, execution of an infected .COM program will result in a long, slow program load with much disk access while the virus replicates. Bebe is a memory resident virus, though it doesn't behave like one. When the first infected program is executed, it will install a portion of itself memory resident in available free system memory. After being resident for awhile, the virus will activate. At activation, it will emit a "click" on the system speaker, and the system will then be hung. Bebe does not replicate on 386 class systems, on those systems execution of a Bebe-infected program will result in a system hang.