Green Joker Virus

Virus Name: Green Joker Aliases: Green V Status: Rare Discovered: June, 1992 Symptoms: .COM file growth; file date/time changes; messages; beeping Origin: Unknown Eff Length: 743 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, ViruScan, F-Prot, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Green Joker, or Green, virus was submitted in June, 1992. Its origin or point of isolation is unknown. Green Joker is a non- resident, direct action infector of .COM programs, including COMMAND.COM. It may be related to the Ash virus. When a program infected with the Green Joker virus is executed, this virus will infect all of the .COM programs located in the current directory. If COMMAND.COM is located in this directory, it will become infected. Programs infected with the Green Joker virus will have a file length increase of 743 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The Green Joker virus will usually display a message on the system display when an infected program is executed. Occassionally, the message will be accompanied by beeping on the system speaker. The messages which may be displayed by the virus are: "Fail on INT 24" "Impotence error reading user's dick Abort, Retry, Ignore, Fail?" "Program too big to fit in memory" "JOKER!" "Cannot load COMMAND, system halted" The above message text strings can be found within the viral code in infected programs, along with the following two additional text strings: "*.COM" "Joker!" Green Joker doesn't do anything besides display its messages and replicate. See: Ash