Mutant Family Virus

Virus Name: Mutant Family Aliases: Mutant 123, Mutant 127, Mutant 128, Tiny Mutant, Tiny-123, Tiny-127 V Status: Rare Discovered: May, 1991 Symptoms: .COM file growth; .COM file corruption; disk boot failure; file date/time change; system hangs Origin: Bulgaria Eff Length: 123 - 128 Bytes Type Code: PONCK - Parasitic & Overwriting Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Mutant Family was submitted in May, 1991, from Bulgaria. The Mutant Family consists of three viruses which behave as both a parasitic file infector and an overwriting file infector. Mutant Family members infect .COM programs, including COMMAND.COM. When a program infected by a member of the Mutant Family is executed, the virus will search the current directory and infect all the .COM files found. Infected programs may either be infected by the virus as a parasitic infection, the file length increasing depending on which variant is present, or the program may be infected by overwriting the beginning of the .COM program. Programs which have an overwriting type of infection are permanently corrupted. Programs which have a parasitic infection will have a file length increase of 123 to 128 bytes, depending on which member of the Mutant Family is present. In any case, the program's date and time in the disk directory will have been updated to the system date and time of infection. Programs infected with a member of the Mutant Family will contain two text strings: "*.com" "VPV" Booting from a diskette which has a Mutant Family member infected COMMAND.COM will result in a boot failure. Attempts to execute programs with Mutant Family infections may result in a system hang. Known member(s) of Mutant Family are: Mutant 123: Originally submitted as V123, this member of the Mutant Family is 123 bytes in length. Generally, programs infected with Mutant 123 will not function properly, even if the infected file has a parasitic infection. Mutant 127: Originally submitted as V127, this member of the Mutant Family is one byte shorter than Mutant 128. It behaves as indicated above. Mutant 128: The original Mutant virus submission, its length is 128 bytes. It behaves as indicated above.