James Bond Virus

Virus Name: James Bond Aliases: V Status: New Discovery: May, 1993 Symptoms: .COM file growth; DOS CHKDSK lost clusters; file date/time seconds set to 62 Origin: The Netherlands Eff Length: 356 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, AVTK/N, Sweep/N, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The James Bond virus was submitted in May, 1993, and is from The Netherlands. James Bond is a memory resident stealth virus which infects .COM programs, including COMMAND.COM. When the first James Bond infected program is executed, the James Bond virus will become memory resident in a "hole" in allocated system memory, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. Once memory resident, James Bond will infect .COM programs, including COMMAND.COM, when they are executed or opened for any reason. Infected programs will have a file length increase of 356 bytes, with the virus being located at the end of the file. The file length increase will be hidden by the virus in memory on some infected files, and will be visible on other infected files. The program's date and time in the DOS disk directory listing appear to be unaltered, but the seconds field will have been set to "62". The following text string occurs very near to the end of all infected programs: "James Bond is Alive!" Systems infected with the James Bond virus will find that the DOS CHKDSK program will report a very high number of lost clusters when it is executed with the virus memory resident.