Nazgul Virus

Virus Name: Nazgul Aliases: V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth; programs fail to function properly; boot failure Origin: The Netherlands Eff Length: 266 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Nazgul virus was submitted in December, 1992. It is originally from The Netherlands. Nazgul is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Nazgul virus is executed, the Nazgul virus will infect all of the .COM programs located in the current directory. If COMMAND.COM is located in this directory, it will become infected. Programs infected with the Nazgul virus will have a file length increase of 266 bytes with the Nazgul virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in all Nazgul infected programs: "*.COM Nazg–l" Programs infected with the Nazgul virus will fail to function properly, returning to the DOS prompt after the virus has accessed the current drive current directory to infect programs. If the boot copy of COMMAND.COM becomes infected, the system will fail to boot.