ECW-X Virus

Virus Name: ECW-X Aliases: ECW-X.570 V Status: New Discovered: January, 1995 Symptoms: .COM file growth; file date/time changes; message; system hangs Origin: Unknown Eff Length: 570 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, ViruScan, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Innoc, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The ECW-X virus was received in January, 1995. Its origin or point of isolation is unknown. ECW-X is a non-resident, direct action infector of .COM files, includig COMMAND.COM. When a program infected with the ECW-X virus is executed, this virus will infect one .COM file located in the current directory, and display one of the following messages: "Evil Crusader Warrior X will rule..!!!!!!!!!!" "ECW-X Rules the Universe , Kneel for your righteous Ruller Forever!!!" This message, however, may sometimes be followed by a repeated portion of the message or some text from the host program. A system hang may also occur, either with or without the message. Programs infected with the ECW-X virus will have a file length increase of 570 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are visible within the viral code in all infected files: "Evil Crusader Warrior X will rule..!!!!!!!!!!" "ECW-X Rules the Universe , Kneel for your righteous Ruller Forever!!!" "*.com" "????????COM"