Ed Virus

Virus Name: Ed Aliases: V Status: Rare Discovered: November, 1992 Symptoms: .COM & .EXE file growth; decrease in total system and available free memory Origin: Finland Eff Length: 779 - 794 Bytes Type Code: PRtAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, VAlert, PCScan, NAV, NAVDX, ChAV, NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Ed virus was submitted in November, 1992. It is originally from Finland. Ed is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. It spreads quickly on infected systems. When the first Ed infected program is executed, the Ed virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,584 bytes. Interrupts 12, 21, and 24 will be hooked by Ed in memory. Once the Ed virus is memory resident, it will infect .COM and .EXE programs when they are executed or opened for any reason. Infected .COM programs will have a file length increase of 779 bytes with the virus being located at the beginning of the file. Infected .EXE programs will increase in size by 779 to 794 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code in infected programs. It is unknown what Ed does besides replicate.