10 Past 3 Virus

Virus Name: 10 Past 3 Aliases: 748 V Status: Rare Discovery: 1991 Symptoms: .COM file growth; keyboard keypresses altered; system reboots; hardware devices disabled or interference Origin: Unknown Eff Length: 748 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: AVTK, F-Prot, IBMAV, ViruScan, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 10 Past 3, or 748, virus was submitted in November, 1992. This virus was actually isolated much earlier, in early 1991. 10 Past 3 is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with the 10 Past 3 virus is executed, this virus will install itself memory resident in low available system memory, hooking interrupts 21 and 6B. Total system and available free memory, as measured by the DOS CHKDSK program, will not be altered. Once the 10 Past 3 virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 748 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code. The 10 Past 3 virus activates between 15:10 and 15:13 (3:00PM and 3:15PM) every day, at which time it will cause the "Ctrl" or "Shift" keys to be invokes occassionally when the system user enters a character on the system keyboard. As a result, the character input may not be the same as what the user intended. Additionally, it either disables or interfers with the functioning of the following devices on the days of any month indicated below: 1st day of any month - keyboard 10th day of any month - system hard disk 16th day of any month - system monitor/display 29th day of any month - disk drives On the 22nd day of any month, unexpected system reboots may occur. Known variant(s) of 10 Past 3 are: 10 Past 3-B: A 789 byte variant of the 10 Past 3 virus, this variant adds 789 bytes to the .COM programs it infects, including COMMAND.COM. It will occassionally display the following text on the system monitor: "Therese" The text is visible within the viral code in all 10 Past 3-B infected programs. Origin: Republic Of South Africa January, 1993.