FGT Virus

Virus Name: FGT Aliases: V Status: Rare Discovered: January, 1992 Symptoms: .COM file growth; loss of CMOS Setup information Origin: Unknown Eff Length: 651 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The FGT virus was received in January, 1992. Its origin or point of isolation is unknown. FGT is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the FGT virus is executed, the FGT virus will search the current directory for up to two previously uninfected .COM files to infect. When these files are found, the virus will infect them. The host program will then execute. Programs infected with the FGT virus will have a file length increase of 651 bytes. The virus will be located at the beginning of the infected program. The file's date and time in the DOS disk directory listing will not have been altered. Programs infected with FGT can be easily identified as they will always start with the following ASCII text string: "PSQRVW" Systems infected with FGT may experience the machine loosing some of its CMOS setup information. In particular, the system clock may appear to have "lost power", returning to a default date, and the system's memory size may become invalid. These setup programs can be easily fixed with the Setup utility or firmware setup facility on the system.