Digger Virus

Virus Name: Digger Aliases: V Status: Rare Discovered: October, 1992 Symptoms: .COM file growth; .EXE file corruption; unexpected system reboots Origin: USSR Eff Length: 1,475 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, Sweep, IBMAV, F-Prot, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Digger virus was received in October, 1992. It is originally from the USSR. Digger is a non-resident, direct action infector of .COM programs, including COMMAND.COM. It will also corrupt .EXE programs. When a program infected with the Digger virus is executed, this virus will infect one program located on the C: drive. It starts infecting programs in the C: drive root directory, and will slow work its way down the directory structure. .COM programs infected by the Digger virus will have a file length increase of 1,475 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in all infected programs: "C) DIGGER" The Digger virus will corrupt .EXE programs which it encounters when it is searching for a .COM program to infect. These corrupted programs will be completely overwritten with other code, which appears to be from system memory. It is unknown what Digger may do besides replicate and corrupt .EXE programs.