Chris Virus

Virus Name: Chris Aliases: V Status: Rare Discovery: November, 1993 Symptoms: .COM file growth; file date/time changes; system hangs; beeping and display of message; programs fail to function Origin: Italy Eff Length: 463 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: F-Prot, ViruScan, AVTK, Sweep, IBMAV, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N Removal Instructions: Delete infected files General Comments: The Chris virus was received in November, 1993. It appears to be from Italy. Chris is a memory resident infector of .COM programs, including COMMAND.COM. When the first Chris infected program is executed, the Chris virus will install itself memory resident in available system memory, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK, will not be altered. Once memory resident, the Chris virus will infect .COM programs when they are executed. Infected programs will have a file length increase of 463 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. One text string is visible within the viral code in infected programs: "" The following text string is encrypted within the viral code: "Mary,.... ti AMO!" This second text string is occassionally displayed by the virus as a message on the system monitor, accompanied by beeping. When the message is displayed, a system hang may also occur. Infected programs may not function properly as a result.