AcidWarp Virus

Virus Name: AcidWarp Aliases: V Status: Viron Discovery: January, 1995 Symptoms: .COM & .EXE programs overwritten; programs fail to execute; programs may become invalid programs; message; file date/time changes; system hangs Origin: Unknown Eff Length: 5,488 Bytes Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector Detection Method: NAV, NAVDX, ViruScan, AVTK 7.68+, NAV/N, NShld, AVTK/N 7.68+ Removal Instructions: Delete infected files General Comments: The AcidWarp virus was received in January, 1995. Its origin or point of isolation is unknown. AcidWarp is a non-resident, direct action overwriting virus which infects .COM and .EXE files, including COMMAND.COM. It permanently corrupts the programs it infects. When a program infected with the AcidWarp virus is executed, this virus will infect two .EXE or .COM files located in the current directory. Infected programs will have the first 5,488 bytes of the host program overwritten by the viral code. Programs smaller than 5,488 bytes will become 5,488 bytes in length, while programs which were originally larger than 5,488 bytes will not increase in size. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are visible within the viral code in all AcidWarp infected programs: "SMARTCHk.CPS" "SMARTCHK.CPS" "CHKLIST.CPS" "CHKLIST.MS" "Program too big to fit in memory" "*.exe" "*.com" "Hey man!" "Looks like you've been fucked by" "(o)(o) the ACiDWARP virus!" "Don't worry, your wife is still a" "virgin!" "acidwarp virus'copyright (c) 1994 all rights reserved" "coded by Nothing Man [MHS]" "Runtime error at" "Portions Copyright (c) 1983,90 Borland" Once all of the .COM and .EXE files in the current directory have become infected by the virus, execution of an infected program will result in a graphic of Bart Simpson being shown in the lower left hand corner of the system display, along with the message contained in the eighth through fourteenth text strings above. A system hang may occur instead of this graphic. Some programs infected with the AcidWarp virus will become invalid programs, and may be flagged as such by some anti-viral software. These invalid programs will not spread the virus.