Oropax Virus

Virus Name: Oropax Aliases: Music Virus, Musician V Status: Rare Discovered: December, 1989 Symptoms: .COM growth; tunes Origin: Eff Length: 2,756 - 2,806 bytes, but usually 2,773 bytes Type Code: PRC - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, or delete infected files General Comments: The Oropax virus has had several reports, but wasn't first isolated until December 1989. It infects .COM files, increasing their length by between 2,756 bytes and 2,806 bytes. Infected files will always have a length divisible by 51. The virus may become active (on a random basis) five minutes after infection of a file, playing three different tunes with a seven minute interval in between. One variant recently reported in Europe plays six different tunes at seven minute intervals. Known variant(s) of Oropax are: Oropax-B: Received in May, 1992, this variant only infects .COM files other than COMMAND.COM when they are opened. Infected files will have a file length increase of 2,755 to 2,800 bytes with the virus being located at the end of the infected file. It will be memory resident as a low system memory TSR of 3,072 bytes, hooking interrupts 21, CC, and F8. Origin: Unknown May, 1992. Oropax-C: Received in November, 1993, this variant is a minor variant of Oropax which has been modified to avoid detection by one particular anti-viral utility. It is not in the public domain. Origin: Unknown November, 1993. Oropax-D: Received in November, 1993, this variant is a minor variant of Oropax which has been modified to avoid detection by one particular anti-viral utility. It is not in the public domain. Origin: Unknown November, 1993.