Bit Addict Virus

Virus Name: Bit Addict Aliases: V Status: Rare Discovery: November, 1992 Symptoms: .COM file growth Origin: The Netherlands Eff Length: 477 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: F-Prot, Sweep, AVTK, ViruScan, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, LProt, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Bit Addict virus was received from the Netherlands in November, 1992. Bit Addict is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with the Bit Addict virus is executed, the Bit Addict virus will install itself memory resident in Video Card Memory, with a hook to this memory resident in low available memory. Interrupt 21 will be hooked by the virus in memory. The DOS CHKDSK program will not indicate any decrease in total system and available free memory. Once the Bit Addict virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 477 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in all Bit Addict infected programs: "BIT ADDICT" "The Bit Addict says" "You have a good taste for hard disks, it was delicious !!!" It is unknown what this virus may do besides replicate. Known variant(s) of Bit Addict are: Bit Addict-496: Received in July, 1993, Bit Addict-496 appears to be an earlier version of the virus described above. It installs a 2,576 byte TSR when the first infected program is executed, hooking interrupt 21. Once memory resident, this virus infects .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 496 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. No text strings are visible within the viral code. Origin: Unknown July, 1993.