Butterflies Virus

Virus Name: Butterflies Aliases: Butterflies-302, Goddamn Butterflies V Status: Common Discovery: June, 1993 Isolated: Illinois, United States Symptoms: .COM file growth; system hangs may occur Origin: Unknown Eff Length: 302 Bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: AVTK, NAV, F-Prot, IBMAV, ViruScan, Sweep, NAVDX, VAlert, PCScan, ChAV, NProt, AVTK/N, Sweep/N, NShld, NAV/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Butterflies, Butterflies-302 or Goddamn Butterflies, virus was received in June, 1993 from a VSUM user in the state of Illinois in the United States. Butterflies is a non-resident, direct action infector of .COM programs, but not COMMAND.COM. It has been given a status of Common as many reports of this virus were received in mid to late June 1993 due to its distribution on a shareware communications package. These reports were from the United States, Canada, Europe, and Israel. As such, its origin is unknown. When a program infected with the Butterflies virus is executed, this virus will infect all of the .COM files located in the current directory which meet its selection criteria. Infected programs will have a file length increase of 302 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Butterflies infected programs: "Goddamn Butterflies" "*.COM" Butterflies doesn't appear to do much besides replicate, though system hangs may unexpectantly occur when infected programs are executed. Known variant(s) of Butterflies are: Crusades: Based on the Butterflies virus described above, this variant will infect three or four .EXE files in the current directory when an infected program is executed. Infected programs increase in size by 302 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Crusades infected programs: "Hurray The Crusades" "*.EXE" System hangs frequently occur when infected programs are executed. Origin: Unknown July, 1993. Crusades COM: Similar to the Crusades variant, this variant will infect four .COM files in the current current directory when an infected program is executed. Infected programs increase in size by 302 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Crusades COM infected programs: "Hurray The Crusades" "*.COM" Origin: Unknown January, 1994.