Curse IV Virus

Virus Name: Curse IV Aliases: V Status: New Discovery: July, 1994 Symptoms: .COM & .EXE growth Origin: Unknown Eff Length: 400 Bytes Type Code: PRaAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, IBMAV, ViruScan, Sweep, NAVDX, VAlert, NAV, AVTK/N, Sweep/N, IBMAV/N, NShld, NProt, NAV/N Removal Instructions: Delete infected files General Comments: The Curse IV virus was received in July, 1994. Its origin or point of isolation is unknown. Curse IV is a memory resident infector of .COM and .EXE files, including COMMAND.COM. When the first Curse IV infected program is executed, this virus will install itself memory resident in a "hole" in allocated system memory. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. The virus will have hooked interrupt 21. Once memory resident, the Curse IV virus will infect .COM and .EXE files when they are executed. Infected programs will increase in size by 400 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Curse IV infected files: "CURSE IV - Dedicated to Eve" The Curse IV virus reinfect some previously infected files, adding an additional 400 bytes with each reinfection by the virus. It does not infect .EXE files which are larger than 64K in size.