Junior Virus

Virus Name: Junior Aliases: V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth Origin: Bulgaria Eff Length: 234 Bytes Type Code: PRaCK - Parasitic Resident .COM Infector Detection Method: AVTK, F-Prot, IBMAV, Sweep, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Junior virus was submitted in December, 1992. It is originally from Bulgaria. Junior is a memory resident infector of .COM programs, including COMMAND.COM. When the first Junior infected program is executed, the Junior virus will install itself memory resident in a "hole" in allocated system memory at approximately 0000:0500. Total system and available free memory, as indicated by the DOS CHKDSK program, will not be altered. No interrupts are directly hooked by the virus. Once the Junior virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 234 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. One text string is visible within the viral code in Junior infected programs: "Jr" This text string occurs at or very near the end of the infected program.