Entity Virus


 Virus Name:  Entity 
 Aliases:     Entity.1986 
 V Status:    New 
 Discovered:  January, 1996 
 Symptoms:    .COM & .EXE growth; decrease in available free memory; 
              file date/time seconds = "62" 
 Origin:      Unknown 
 Eff Length:  1,986 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method: ChAV, F-Prot, AVTK, IBMAV, ViruScan, PCScan, 
                   NAV, NAVDX, 
                   Innoc, AVTK/N, IBMAV/N, NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Entity or Entity.1986 virus was received in January, 1996.  Its 
       origin or point of isolation is unknown.  Entity is a memory 
       resident stealth virus which infects .COM and .EXE files, 
       including COMMAND.COM. 
 
       When the first Entity infected program is executed, this virus 
       will install itself memory resident at the top of system memory 
       but below the 640K DOS boundary, not moving interrupt 12's return. 
       Available free memory, as indicated by the DOS CHKDSK program 
       from DOS 5.0, will have decreased by 4,032 bytes.  Interrupts 11 
       and 21 will be hooked by the virus in memory. 
 
       Once the virus is memory resident, it will infect .COM and .EXE 
       files, including COMMAND.COM, when they are executed or opened, 
       but not when copied.  Infected files will have a file length 
       increase of 1,986 bytes, though this file length increase will 
       be hidden by the virus when it is memory resident.  The virus will 
       be located at the end of the file.  The program's date and time 
       in the DOS disk directory listing will not appear to be altered, 
       though the seconds field will have been set to "62".  The 
       following text strings are encrypted within the viral code: 
 
           "Hello user. I am a computer virus. My name is Entity." 
           "First: The keyboard is locked. Don't worry, it will be" 
           "unlocked at the end of this message." 
           "I am here because of your illegal software copying and" 
           "I am carrying a message for you from my programmer:" 
           "Buy only ORIGINAL SOFTWARE. Today the risk of infection" 
           "by a virus is very high (as you can see) and, next time," 
           "you could be visited by an harmful virus which can perform" 
           "serious damage to your hard disk, floppies and backups..." 
           "So, pay attention while getting pirated software from CDs" 
           "and/or criminal BBSs. Pirating software is a federal crime." 
           "[This warning comes from Entity virus (c) 1995 by The Nuker]"

Show viruses from discovered during that infect .

Main Page