Macedonia Virus

Virus Name: Macedonia Aliases: V Status: Rare Discovered: January, 1992 Symptoms: .COM file growth Origin: Unknown Eff Length: 400 Bytes Type Code: PRC - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files, & DOS SYS command General Comments: The Macedonia virus was received in January, 1992. Its origin or point of original isolation is unknown. Macedonia is a memory resident infector of .COM programs. The first time a program infected with Macedonia is executed, the virus will install itself memory resident in available system memory. There will be no decrease in total system or available free memory as indicated by the DOS CHKDSK program. Interrupt 21 will be hooked by the virus. Once Macedonia is memory resident, it will occasionally infect a .COM file when another program is executed. Infected .COM files will have a file length increase of 400 bytes with the virus being located at the end of the infected program. There will be no change to the file's date and time in the DOS disk directory listing. The following text strings can be found within the viral code in Macedonia infected programs: "MacedoniaToTheMacedonians" "*.COM" It is unknown if Macedonia does anything besides replicate.