Best Wishes Virus

Virus Name: Best Wishes Aliases: Best Wish, Wishes V Status: Rare Discovery: December, 1990 Symptoms: .COM file growth; decrease in system and available free memory; system hangs; file date/time changes; file not found errors; boot sector modification Origin: USSR Eff Length: 970 Bytes Type Code: PRtCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Best Wishes virus was submitted in December, 1990 and is believed to be from the USSR. Best Wishes is a memory resident infector of .COM files, including COMMAND.COM. There is a variant of this virus, Best Wishes B, which is 1,024 bytes in length. The first time a program infected with the Best Wishes virus is executed, the virus will install itself memory resident in system high memory, but below the 640K DOS boundary. The interrupt 12 return will be moved. Total system memory will decrease by 61,440 bytes, available free memory will decrease by 61,360 bytes. COMMAND.COM will become infected at this time, and the disk's boot sector will also be modified. Disks with the boot sector modification and infected COMMAND.COM will still boot properly. After Best Wishes is resident, the virus will infect .COM files as they are executed with a probability of 50%. Infected .COM files will increase in length by 970 bytes with the virus being located at the end of the infected file. Infected programs will also have the following text string located near the end of the file: "This programm ... With Best Wishes!" Best Wishes does not restore the original file date and time in the directory when it infects programs, so all infected programs will have their date/time stamps set to the system date and time when infection occurred. Two additional symptoms of a Best Wishes infection are that the user may experience "File not found" errors when the file is actually on disk, as well as system hangs on every fourth program execution. Known variant(s) of Best Wishes are: Best Wishes B: An earlier version of Best Wishes, this variant is 1,024 bytes in length. The major differences are that infected disks will not boot if COMMAND.COM has been modified. Execution of a .COM program once the virus is memory resident will result in the program most likely being infected, but the system will also hang. Best Wishes C: Another variant of Best Wishes, this variant does not hang the system when .COM programs are infected by the virus. Execution of .EXE programs, however, will usually result in a system hang.