Mix2 Virus

Virus Name: Mix2 Aliases: V Status: Rare Discovered: March, 1991 Symptoms: .COM & .EXE growth; system hangs; decrease in total system and available free memory Origin: Europe Eff Length: 2,287 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Mix2 virus was submitted in March, 1991. Original reports of this virus were received from Europe. Mix2 is based on the Mix1 virus, and is a memory resident infector of .COM and .EXE files. It does not infect COMMAND.COM When the first program infected with Mix2 is executed, Mix2 will install itself memory resident at the top of system memory, but below the 640K DOS boundary. It will mark this area of reserved memory "COMMAND Data" and will hook interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will decrease by 3,040 bytes. Interrupt 12's return will not be moved. Once Mix2 is memory resident, it will infect .COM and .EXE programs over 9K in length when they are executed. Infected programs will increase in length by 2,287 to 2,294 bytes with the virus being located at the end of the infected file. This virus does not alter the file date and time in the disk directory. Some programs which are memory intensive, or which allocate all available memory will hang when executed with Mix2 memory resident. It is unknown what Mix2 does besides replicate. See: Mix1