Multi-Face Virus

Virus Name: Multi-Face Aliases: MFace V Status: Rare Discovered: January, 1992 Symptoms: .COM file growth; TSR; file date/time changes; smiley face characters moving on display; write protect errors; system slowdown Origin: Unknown Eff Length: 1,441 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: Sweep, ViruScan, F-Prot, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Multi-Face virus was submitted in January, 1992. Its origin or point of original isolation is unknown. Multi-Face is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with the Multi-Face virus is executed, this virus will install itself memory resident in low available system memory. Memory mapping utilities may indicate that the Config area of memory has increased in size by 1,456 bytes. The DOS CHKDSK program will indicate that available free memory has decreased by approximately 64K in addition to the 1,456 bytes in size by the virus. Interrupts 08, 13, and 21 will be hooked by the Multi-Face virus in memory. After the Multi-Face virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 1,441 bytes with the virus being located at the end of the infected file. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time. Symptoms of an infection of the Multi-Face virus are that a minor system slowdown will have occurred. The slowdown is most noticable when the system display is scrolled. .COM program date and time in the DOS disk directory listing will have been updated when programs are executed if the system date is different from the program date. Write protect errors will occur when attempting to execute .COM programs on write protected diskettes. Lastly, multiple smiley face characters may appear on the system display, moving around the other characters on the screen.