Month 4-6 Virus

Virus Name: Month 4-6 Aliases: Agi-plan V Status: Rare Discovered: 1989? Symptoms: .COM file growth; TSR; system hangs; disk corruption Origin: Unknown Eff Length: 1,536 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: F-Prot, ViruScan, NAV, Sweep, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Month 4-6 or Agiplan virus was received in October, 1992, though it has been rumored to exist since 1989. The origin of the sample received is unknown. Month 4-6 is a memory resident infector of .COM programs, including COMMAND.COM. When the first Month 4-6 virus infected program is executed, this virus will install itself memory resident as a low system memory TSR, hooking interrupts 21 and 24. Unless the virus becomes memory resident from COMMAND.COM, the system will usually hang at this point, receiving an error that it cannot load the command interpretor. Once memory resident, Month 4-6 will infect .COM programs when they are executed. Infected programs will have a file length increase of 1,536 bytes with the virus being located at the beginning of the file. The file's date and time will not be altered. Two text strings can be found within the viral code in infected programs: "load error" "COMMAND.COM" The Month 4-6 virus activates when it becomes memory resident between April 1st and June 30th of any year, hence its name. At that time, the virus will trash the current drive.