CD Virus

Virus Name: CD Aliases: Thursday The 12th V Status: Rare Discovery: August, 1991 Symptoms: .COM & .EXE growth; decrease in total system & available free memory; disk write protect errors Origin: Germany Eff Length: 2,161 - 2,175 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The CD virus was submitted in August, 1991, from Germany. CD is a memory resident infector of .COM and .EXE files, and does not infect COMMAND.COM. On Thursdays that are the 12th day of the month, it will display a message. The first time a program infected with CD is executed, CD will install itself memory resident at the top of system memory, but below the 640K DOS boundary. Total system and available free memory, as measured by the DOS CHKDSK program, will have decreased by 2,448 bytes. Interrupt 21 will be hooked by the CD virus in memory. Once memory resident, CD will infect .COM and .EXE programs when they are executed if their original file length was less than approximately 63K bytes. Infected programs increase in size by 2,161 to 2,175 bytes with the virus being located at the end of the infected file. Attempts to execute programs from write protected diskettes with CD memory resident will result in a write protect error as the virus does not intercept this error condition. On Thursdays that are the twelveth day of the month, it will display the following message after every fourth program is executed: ÉÍÍÍÍÍÍÍÍÍÍÍÍÍ VirCheck V1.2 (C) 1991 ÍÍÍÍÍÍÍÍÍÍÍ» º Be aware of those worms out there, violating º º your machine on Friday 13th = it's tomorrow! º º º º Special thanks to Ross M. Greenberg, º º Patricia M. Hoffmann and John McAfee º º º ÈÍÍÍÍÍÍÍÍÍ Press any key to continue... ÍÍÍÍÍÍÍÍͼ The virus does not do anything besides display the message in the highlighted box in the center of the screen. If the system user strikes any key, the program they were attempting to execute will be then execute. Known variant(s) of CD are: Thursday The 12th: Similar to CD, this variant's major change is that it will also infect programs on open as well as execution. This variant was isolated in Iceland, and was received in September, 1991.