310 Virus

Virus Name: 310 Aliases: DM.310 V Status: Rare Discovery: January, 1992 Symptoms: .COM file growth; write protect errors Origin: Unknown Eff Length: 310 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: Sweep, ViruScan, F-Prot, AVTK, NAVDX, NAV, IBMAV, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 310 virus was received in January, 1992. Its origin is unknown. This virus is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with 310 is executed, the 310 virus will install itself memory resident in available free memory, hooking interrupts 21 and 63 in the interrupt area. There will be no change to total system and available free memory as indicated by the DOS CHKDSK program. Once the 310 virus is memory resident, it will infect .COM programs when they are executed. If COMMAND.COM is executed, it will become infected. Programs infected with the 310 virus will have a file length increase of 310 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will not have been altered. Systems infected with the 310 virus will notice that attempts to execute programs from write protected diskettes will result in a write protect error message being displayed by DOS. This occurs because the virus doesn't check for the error and properly handle it.