Virus Name: Amstrad
V Status: Viron
Discovery: November, 1989
Symptoms: .COM growth; message; programs overwritten; system hangs
Eff Length: 847 Bytes
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: F-Prot, or delete infected files
The Amstrad virus was first reported in November, 1989, by Jean Luz
of Portugal; however, it has been known of in Spain and Portugal for
a year prior to that. The virus is a generic .COM infector, but is
not memory resident. It will infect COMMAND.COM. It is based on
the Pixel virus.
When a program infected with Amstrad is executed, the Amstrad virus
will infect three .COM files, located in the current directory.
Infected files not have a file length increase as they will have been
overwritten by the viral code.
The virus carries a fake advertisement for the Amstrad computer:
"=!= Buy AMSTRAD it is THE CHEAPEST COMPUTER that you can buy"
The Amstrad virus doesn't do anything besides replicate.
Known variant(s) of Amstrad are:
Amstrad-End Is Near: The Amstrad-End Is Near variant is very
similar to the original Amstrad virus. The major difference
is that the text strings have been changed to:
"=!= THE END IS NEAR!!
THE SIGNS OF THE BEAST ARE EVERYWHERE"
The first .COM file in the current directory will increase
in size by 847 bytes when it is infected. Other .COM files
will not have a file length increase as the virus will
overwrite part of the host program.
Origin: Unknown 1990
Amstrad-End Is Near B: This variant is a very minor variant of the
Amstrad-End Is Near virus. It infects the first five .COM
files in the current directory when an infected program is
executed. Infected programs will have a file length increase
of 847 bytes with the virus being located at the beginning of
the file. It contains the same text strings as the original
End Is Near variant.
Origin: Unknown January, 1994.
Amstrad-Luz: The Amstrad-Luz variant is very similar to the
original Amstrad virus. The text strings have been
"=!= Hello, John Mcafee,please uprade me.
Bests regards,Jean Luz"
Origin: Portugal November, 1989
See: Hell Pixel Silly Silly-365