Groen Links Virus

Virus Name: Groen Links Aliases: Green Left V Status: Rare Discovered: March, 1990 Symptoms: .COM & .EXE growth; TSR; music Origin: Amsterdam, Holland Eff Length: 1,888 Bytes Type Code: PRsA - Resident Parasitic .COM &.EXE Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Groen Links virus was originally reported in Amsterdam, Holland, in March 1990. This virus is a memory resident infector of .COM and .EXE files. It does not infect COMMAND.COM. It is a variant of the Jerusalem virus, though is listed separately here as it is a different length and exhibits different characteristics. The first time a program infected with the Groen Links virus is executed, the virus will install itself memory resident as a low system memory TSR of 1,872 bytes. Interrupts 21 and CE will be hooked by the virus. After the virus is memory resident, it will infect .COM and .EXE files as they are executed. Infected .COM files will increase in length by 1,893 bytes with the virus being located at the beginning of the file. .EXE files will increase in length by 1,888 to 1,902 bytes with the virus located at the end of infected files. As with many of the Jerusalem variants, this virus will reinfect .EXE files. After the first infection, .EXE files will increase by 1,888 bytes on subsequent infections. Infected files will contain the text string: "GRLKDOS". After the virus has been resident for 30 minutes, it may play "Stem op Groen Links" every 30 minutes. The name of the tune translates to "Vote Green Left", Green Left being a political party in Holland. See: Jerusalem