Mosquito Virus

Virus Name: Mosquito Aliases: Fax Free V Status: Rare Discovered: August, 1991 Symptoms: .EXE growth; TSR; function keys fail to operate properly; expanding decrease in available free memory Origin: Unknown Eff Length: 1,028 - 1,040 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Mosquito virus was submitted in August, 1991. Its origin, or location of discovery, is unknown. Mosquito is a memory resident infector of .EXE and overlay files, though it will not infect files which contain the word "scan" in the file name. The first time a program infected with Mosquito is executed, Mosquito will become memory resident as a low system memory TSR of 2,128 bytes. Interrupt 21 will be hooked by the virus in memory. Once memory resident, Mosquito will infect .EXE programs and overlay files on drives other than drive A: when they are executed. Infected programs will increase in size by 1,028 to 1,040 bytes, the virus will be located at the end of the infected file. Programs infected with the Mosquito virus will also contain the text string "Mosquito". Systems infected with Mosquito will experience a gradual decrease in available free system memory as the user executes programs. The gradual decrease occurs because Mosquito will allocate an additional 48 bytes of low system memory each time it infects a file. Function keys may also fail to function properly on infected systems. It is unknown if Mosquito does anything besides replicate. Known variant(s) of Mosquito are: Lamer: Based on the Topo variant described below, Lamer is a later variant of this virus. Lamer's memory resident TSR is 3,136 bytes and hooks interrupt 21. It will infect .EXE and overlay programs when they are executed, adding 1,542 - 1,552 bytes to their length. The virus will be located at the end of infected files. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in infected programs: "Lamer Exterminator II" "Copyright 07.12.91 by Genius" Encrypted within the viral code are the following two text strings: "FaX Free!!" "Welcome" Origin: Unknown July, 1992. Pfish: Based on the Topo variant described below, Pfish is a later variant of this virus. PFish's memory resident TSR is 3,136 bytes and hooks interrupt 21. It will infect .EXE and overlay programs when they are executed, adding 1,542 - 1,552 bytes to their length. The virus will be located at the end of infected files. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in infected programs: "COMSPEC=C:\DOS\COMMAND.COM PATH=C:\DOS;C:\WIN3;C:\;C:\TOPO; C:\UTILITY" "PROMPT=$p$g TEMP=C:\WIN3\TEMP" "C:\WORK\FISHVIRUS.COM" "PFISHVIRUS" Origin: Italy October, 1992. Topo: Based on the Mosquito virus described above, Topo is a later variant of this virus. Topo's memory resident TSR is 3,136 bytes and hooks interrupt 21. It will infect .EXE and overlay programs when they are executed, adding 1,542 - 1,552 bytes to their length. The virus will be located at the end of infected files. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within the viral code in infected programs: "COMSPEC=C:\DOS\COMMAND.COM PATH=C:\DOS" "PHORSEFAX" Topo does not intercept disk errors, so attempts to execute programs on write protected diskettes will result in write protect errors. Origin: Unknown July, 1992.