Fat Table Virus

Virus Name: Fat Table Aliases: V Status: Viron Discovered: March, 1993 Symptoms: .EXE file corruption; .EXE file truncation; file date/time changes; file allocation errors Origin: Unknown Eff Length: 6,540 Bytes Type Code: ONE - Overwriting Non-Resident .EXE Infector Detection Method: [Not in Certification Set] Removal Instructions: Delete infected files General Comments: The Fat Table virus was submitted in March, 1993. Its origin or point of isolation is unknown. Fat Table is a non-resident, direct action overwriting virus which corrupts the .EXE programs it infects. When a program infected with the Fat Table virus is executed, the Fat Table virus will infect one .EXE program located in the current directory by overwriting the program with the viral code and a filler of hex 00 characters. Infected programs will usually not increase in size, but instead may show a size decrease. The first 6,540 bytes of the resulting infection will be the viral code. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings can be found within the viral code in all Fat Table virus infected programs: "hitohana" "karu ba" "rb C:\ * .* FAT TABLE E" "8RROR" "EXE" "COM" Programs infected with the Fat Table virus will not function properly. The DOS CHKDSK program will return file allocation errors on most, if not all, infected programs.