Egg-1000 Virus

Virus Name: Egg-1000 Aliases: Egg V Status: Rare Discovered: January, 1993 Symptoms: COMMAND.COM & .EXE growth; decrease in total system & available free memory Origin: Unknown Eff Length: 1,000 - 1,014 Bytes Type Code: PRhEK - Parasitic Resident COMMAND.COM & .EXE Infector Detection Method: AVTK, F-Prot, IBMAV, Sweep, ViruScan, NAV, PCScan, NAVDX, VAlert, ChAV, AVTK/N, Sweep/N, NAV/N, NShld, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Egg-1000, or Egg, virus was submitted in January, 1993. Its origin or point of isolation is unknown. Egg-1000 is a memory resident infector of .EXE files and COMMAND.COM. When the first Egg-1000 infected program is executed, the Egg-1000 virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupts 21 and 6C. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,280 bytes. Interrupt 12's return will not be moved. Also at this time, the virus will infect COMMAND.COM if it was not previously infected. Once the Egg-1000 virus is memory resident, it will infect .EXE programs when they are executed or opened for any reason. Infected programs will have a file length increase of 1,000 to 1,014 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Egg-1000 infected programs: "[EGG]-1000 xxxxxxxyyyyyyyzzzzzzz" "eat cry sleep pizza cash getbackjack" "chickens are good" "ribbitribbitmefrogufrogwefrog" "egg" It is unknown what Egg-1000 does besides replicate.