China Virus

Virus Name: China Aliases: V Status: Rare Discovery: March, 1993 Symptoms: .COM & .EXE growth; TSR Origin: China Eff Length: 1,824 - 1,838 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: Sweep, AVTK, F-Prot, ViruScan, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, LProt, NShld, AVTK/N, NAV/N, Innoc, IBMAV/N Removal Instructions: Delete infected files General Comments: The China virus was submitted in March, 1993, and is probably from China. The China virus is a memory resident infector of .COM and .EXE programs, and does not infect COMMAND.COM. It is based on the Jerusalem virus. When the first China infected program is executed, the China virus will install itself memory resident as a low system memory TSR of 2,128 bytes. Interrupts 21 and 24 will be hooked by the China virus in memory. Once memory resident, the China virus will infect .COM and .EXE programs, but not COMMAND.COM, when they are executed. Infected .COM programs will will have a file length increase of 1,831 bytes with the virus being located at the beginning of the file. Infected .EXE programs will have a file length increase of 1,824 to 1,838 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. Unlike many variants of the Jerusalem virus, China does not reinfect previously infected programs. No text strings are visible within the viral code in China infected programs. It is unknown what China may do besides replicate. See: Jerusalem