Fifo Virus

Virus Name: Fifo Aliases: Fifo.300 V Status: New Discovered: February, 1995 Symptoms: .COM file growth; message "Bad command or file name" Origin: Unknown Eff Length: 300 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: F-Prot, ViruScan, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Fifo virus was received in February, 1995. Its origin or point of isolation is unknown. Fifo is a memory resident infector of .COM files, including COMMAND.COM. When the first Fifo infected program is executed, the Fifo virus will infect all of the .COM files located in the current directory, as well as become memory resident. This virus installs itself memory resident in allocated system memory, resulting in no change in total system and available free memory. Interrupt 21 will be hooked by the virus in memory. Once the Fifo virus is memory resident, it will infect .COM files when they are executed. Infected files will have a file length increase of 300 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "NNOO" "*.COM" "FIFO" When the virus is memory resident, attempts to execute EXE files may result in the error message "Bad command or file name" being displayed, and the user being returned to the DOS prompt.