Dark End Virus

Virus Name: Dark End Aliases: V Status: Rare Discovery: December, 1992 Symptoms: .COM & .EXE growth; TSR; overwrites beginning of C:; interfers with screen display; system hangs Origin: Unknown Eff Length: 1,188 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: AVTK, IBMAV, F-Prot, ViruScan, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Dark End virus was submitted in December, 1992. Its origin or point of isolation is unknown. Dark End is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Dark End infected program is executed, the Dark End virus will install itself memory resident as a low system memory TSR of approximately 1,200 bytes, hooking interrupt 21. It will appear as part of the command interpretor in many memory mapping utilities. Once the Dark End virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 1,188 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in all Dark End infected programs: "(c) Dark End." The Dark End virus activates when the first infected program is executed after system boot on October 15th of any year. At that time, the virus will overwrite the first 30 sectors of the C: drive. Systems infected with the Dark End virus may also experience interference with the system display, including unexpected clearing of the screen and the cursor flickering. System hangs may also occur unexpectedly.