Distrust Virus

Virus Name: Distrust Aliases: V Status: Rare Discovered: April, 1994 Symptoms: .COM & .EXE growth; TSR; Available free memory decreases in 64K blocks Origin: Unknown Eff Length: 1,588 - 1,604 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NProt, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Distrust virus was submitted in April, 1994, its origin or point of isolation is unknown. Distrust is a memory resident infector of .COM and .EXE files, but not COMMAND.COM. When the first Distrust infected program is executed, this virus will install itself memory resident as a low system memory TSR of 3,424 bytes, hooking interupts 08, 21, and 24. Once memory resident, the virus will occassionally allocate an additional block of 64K, so available system memory will actually decrease by more than 3,424 bytes. Once the Distrust virus is memory resident, it will infect .COM and .EXE programs, when they are executed. Infected .COM programs will increase in size by 1,588 bytes with the virus being located at the beginning of the file. In the case of .EXE programs, the file will increase in size by 1,594 to 1,604 bytes with the virus being located at the end of the file. In both cases, the file's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code.