Amazon Virus

Virus Name: Amazon Aliases: Amazon.468 V Status: New Discovery: July, 1995 Symptoms: .EXE file growth Origin: Unknown Eff Length: 468 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: F-Prot, AVTK, Sweep, ViruScan, NAV, NAVDX, IBMAV, ChAV, Sweep/N, NShld, NAV/N, AVTK/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Amazon or Amazon.468 virus was received in July, 1995. Its origin or point of isolation is unknown. Amazon is a memory resident infector of .EXE files. When the first Amazon infected program is executed, this virus will install itself memory resident in a hole in allocated system memory, hooking interrupt 21. Once memory resident, it will infect .EXE files when they are executed or opened, but not when they are copied. Infected .EXE files will have a file length increase of 468 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected files: "Amazon Queen...v1.0" "WHY?" "LoRD Zer0" It is unknown what the Amazon virus does besides replicate. Known variant(s) of Amazon are: Amazon.479: Also received in July, 1995, this is a 479 byte variant of the Amazon virus described above. It adds 479 bytes to the .EXE files it infects, and contains the following unencrypted text strings: "Amazon Queen...v1.1" "WHY?" "LoRD Zer0" Origin: Unknown July, 1995. Amazon.500: Received in July, 1995, Amazon.500 is a 500 byte memory resident infector of .COM and .EXE files, including COMMAND.COM. Programs are infected when they are executed or opened, but not on copy. Infected files will have a file length increase of 500 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected files: "Amazon Queen...v2.0" "WHY?" "LoRD Zer0" Some anti-viral programs may fail to function properly when this virus is memory resident. Origin: Unknown July, 1995.