Ministry Virus

Virus Name: Ministry Aliases: V Status: Rare Discovered: April, 1992 Symptoms: .COM file growth Origin: Unknown Eff Length: 1,168 Bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, Sweep, IBMAV, ChAV, NAV, ViruScan, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Ministry virus was submitted in April, 1992. Its origin is unknown. Ministry is a non-resident direct action infector of .COM programs. It does not infect COMMAND.COM. This virus is based on the Beta virus. When a program infected with the Ministry virus is executed, this virus will check the first three non-COMMAND.COM programs in the current directory to determine if they are infected. If the programs aren't infected, it will infect them. Programs infected with the Ministry virus will have a file length increase of 1,168 bytes with the virus being located at the end of the infected program. The file's date and time in the DOS disk directory listing will not be altered. Ministry is an encrypted virus, and their are no text strings visible within the viral code in infected programs. The following text strings are encrypted within the virus: "ask!" "I'm Buring Inside!" "Breathe You Fucker!" "Jesus Built My Hotrod!" "Everyday is Halloween!" "The Ministry Virus - Written by NegativX - (c) 1991 -SiTT-" It is unknown what Ministry does besides replicate. See: Beta Elvis-1250