March 25th Virus

Virus Name: March 25th Aliases: V Status: Rare Discovered: April, 1994 Symptoms: .COM & .EXE file growth; decrease in total system & available free memory; corrupts system hard disk FAT & possibly files on 3/25 Origin: Unknown Eff Length: 1,026 - 1,040 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, Sweep, ViruScan, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, AVTK/N, IBMAV/N, NProt, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The March 25th virus was received in April, 1994. Its origin or point of isolation is unknown. This virus is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. It is destructive when it activates on March 25th of any year. When the first March 25th infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,056 bytes. Interrupt 12's return will not be moved. Once memory resident, the March 25th virus will infect .COM and .EXE programs located on the system hard disk, including COMMAND.COM, when they are executed or opened. It only infects COMMAND.COM on the A: drive. Programs infected with this virus will have a file length increase of 1,026 to 1,040 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code. The March 25th virus activates when the virus becomes memory resident on March 25th of any year. At this time, the virus will overwrite the system hard disk file allocation table. It may also corrupt .COM and .EXE files.