July 13TH Virus

Virus Name: July 13TH Aliases: V Status: Endangered Discovered: April, 1990 Symptoms: .EXE file growth; screen effects on July 13th Origin: Madrid, Spain Eff Length: 1,201 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, F-Prot, NAV, Sweep, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, or delete infected files General Comments: The July 13TH virus was isolated in Madrid, Spain, in April 1990 by Guillermo Gonzalez Garcia. This virus is a generic .EXE file infector, and is not memory resident. When a program infected with the July 13TH virus is executed, the virus will attempt to infect a .EXE file. Files are only infected if they are greater in length than 1,201 bytes. Infected files increase in size by 1,201 to 1,209 bytes. The July 13TH virus activates on July 13TH of any year. At that time, a bouncing ball effect occurs on the system monitor's screen similar to the bouncing ball effect of the Ping Pong virus. While this virus is disruptive, it does not cause any overt damage to files other than infecting them. The bouncing ball effect created by this virus will occasionally leave dots on the screen where it was passing if the screen has been scrolled for any reason. Known variant(s) of July 13TH are: July 13TH-B: Functionally similar to the original July 13TH virus, this variant has been altered to avoid detection by anti-viral programs which are aware of the July 13TH virus. It infects one .EXE file in the current directory when an infected program is executed, adding 1,199 to 1,213 bytes to the file. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "*.EXE \*.V" July 13TH-B activates on July 13th of any year, at which time a bouncing ball will appear on the system display when an infected program is executed. Origin: Unknown March, 1993. July 13TH-C: Functionally similar to the original July 13TH virus, it infects one .EXE file in the current directory when an infected program is executed, adding 1,201 to 1,215 bytes to the file. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the viral code: "*.EXE \*." July 13TH-C only infects programs located in the current drive when the current drive is also a root directory. Origin: Unknown January, 1994.