Hastings Virus

Virus Name: Hastings Aliases: V Status: Viron Discovered: December, 1991 Symptoms: .COM files altered; file date/time changes; .COM files no longer function Origin: USA Eff Length: 200 Bytes Type Code: ONCK - Non-Resident Overwriting .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Hastings virus was isolated in the United States in December, 1991. Hastings is a non-resident, direct action overwriting infector of the first .COM file in a directory. It may infect COMMAND.COM. When a program infected with Hastings is executed, the virus will find the first .COM file in the current directory. If this file has not been previously infected by the Hastings virus, it will infect it. Hastings infected .COM files will have the first 200 bytes of the host program overwritten with the viral code. The file will not have a file length change unless the original file was smaller than 200 bytes, in which case the length will become 200 bytes. The file's date and time in the DOS disk directory will have been updated to the current system date and time when infection occurred. The following text strings can be found within the viral code in programs infected with Hastings: "*.COM by" "AKA Nick Haflinger... Zopy me I want to travel" "I can now program in assembler" "This program was written in the town of Hastings hehehehe!" The Hastings virus does not do anything besides replicating and destroying those programs which it infects. See: Possum