Micropox Virus

Virus Name: Micropox Aliases: K V Status: Rare Discovered: February, 1992 Symptoms: .COM & .EXE growth; decrease in total system & available free memory; corrupts system hard disk Origin: United States Eff Length: 4,928 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, F-Prot, AVTK, PCScan, ChAV, NAV, IBMAV, NAVDX, VAlert, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected programs General Comments: The Micropox virus was submitted in February, 1992. It was isolated in the United States. Micropox is a memory resident infector of .COM and .EXE programs, it does not infect COMMAND.COM. It is destructive when it activates. The first time a program infected with the Micropox virus is executed, the Micropox virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 4,944 bytes. Interrupts 1C and 21 will be hooked by the virus. One .COM and one .EXE program located in the current directory may be infected by the virus at this time. Once the Micropox virus is memory resident, it will infect .COM and .EXE programs when they are executed. Infected programs will have a file length increase of 4,928 bytes. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. No text strings are visible in the viral code in infected programs. The Micropox virus activates when it becomes memory resident in the month of March. During the month of March, execution of the first infected program when the virus is not already memory resident will result in the virus overwriting the system hard disk.