Delwin Virus

Virus Name: Delwin Aliases: Delwin.1759 V Status: In the wild Discovered: July, 1996 Symptoms: .EXE file growth; file date/time seconds = "62"; decrease in total system & available free memory; master boot sector altered Origin: Unknown Eff Length: 1,759 Bytes Type Code: PRtEX - Parasitic Resident .EXE & Master Boot Sector Infector Detection Method: F-Prot, AVTK 7.61+, IBMAV, ViruScan 2.51+, PCScan 5.02+, NAV 3.09 9608+, NAVBoot 0.A 9608+, ChAV, Innoc 4.0+, NProt, AVTK/N 7.61+, IBMAV/N, LProt, NShld 2.32 9607+, NAV/N 2.0 9607+ Removal Instructions: Delete infected programs & Replace MBR General Comments: The Delwin virus was received in July, 1996, and has been reported to be "in the wild". Its origin or point of isolation is unknown. Delwin is a stealth, multi-partite virus which infects the hard disk master boot sector and .EXE files. The first time a program infected with the Delwin virus is executed, this virus will infect the system hard disk master boot record. It does not become memory resident or infect .EXE files at this time. Later, when the system user boots the computer from the system hard disk, Delwin will become memory resident, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 2,048 bytes. Interrupts 13, 1C and 21 will be hooked by the virus in memory. Once this virus is memory resident, it will infect .EXE files when they are executed or opened. Infected .EXE files will have a file length increase of 1,759 bytes, though this file length increase will be hidden when the virus is memory resident. The virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "62". The following text string is encrypted within the viral code: "DELWIN" The Delwin virus is a full stealth virus, disinfecting programs as they are read into memory. As a result, if anti-viral programs are executed with the virus memory resident, they may not detect changes in infected programs if they are unaware of the virus in memory. If you suspect you have this virus, be sure to boot from a known clean system disk before executing anti-viral programs.