Ohm Virus

Virus Name: Ohm Aliases: Ohm.777 V Status: New Discovered: July, 1995 Symptoms: .COM & .EXE growth; DOS CHKDSK file allocation errors; 100 years added to file date; decrease in total system & available free memory Origin: Unknown Eff Length: 777 Bytes Type Code: PRtAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, VAlert, Sweep, NAV, NAVDX, IBMAV, ViruScan, ChAV, Sweep/N, NAV/N, NShld, IBMAV/N, AVTK/N, NProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Ohm virus was received in July, 1995. Its origin or point of isolation is unknown. Ohm is a memory resident infector of .COM and .EXE files, including COMMAND.COM. It does not infect very small .COM and .EXE files. When the first Ohm infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 1,024 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Ohm virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 777 bytes, though this file length increase will be hidden when the virus is memory resident. The file's date and time in the DOS disk directory listing may not appear to be altered, though 100 years will have been added to the file's date. The following text string is visible within the viral code in all infected programs: "Ohm" The DOS CHKDSK program will indicate file allocation errors on all infected programs when the Ohm virus is memory resident.