Dest Virus

Virus Name: Dest Aliases: Dest-1 V Status: Rare Discovered: August, 1992 Symptoms: .COM file growth; file date/time changes Origin: Unknown Eff Length: 323 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, AVTK/N, IBMAV/N, NProt, NAV/N Removal Instructions: Delete infected files General Comments: The Dest, or Dest-1, virus was received in August, 1992. Its origin or point of isolation is unknown. Dest is a non-resident, direct action infector of .COM programs, including COMMAND.COM. There are two later versions of this virus, one of which is a memory resident virus. The later versions of the virus are described below under variants. When a program infected with the Dest virus is executed, the Dest virus will infect one .COM file located in the current drive's current directory. Infected programs will have a file length increase of 323 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. One text string is visible within the viral code in infected programs: "*.com" Dest-1 doesn't do anything besides replicate. Known variant(s) of Dest are: Dest-2: A later version of the Dest or Dest-1 virus described above, this variant adds 478 bytes to the .COM programs it infects. The program's date and time in the DOS disk directory listing will not be altered. There are no text strings visible within the viral code. Origin: Unknown August, 1992. Dest-3: A later version of Dest-2, Dest-3 is a memory resident infector of .COM progams. When the first infected program is executed, it will install itself memory resident at the top of system memory but below the 640K DOS boundary, decreasing total system and available free memory by 2,192 bytes. Interrupts 21 and 22 will be hooked. Once resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 491 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time. Dest-3 doesn't do anything besides replicate. Origin: Unknown August, 1992.