Amstrad Virus


 Virus Name:  Amstrad 
 Aliases:    
 V Status:    Viron 
 Discovery:   November, 1989 
 Symptoms:    .COM growth; message; programs overwritten; system hangs 
 Origin:      Portugal 
 Eff Length:  847 Bytes 
 Type Code:   ONCK - Overwriting Non-Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  F-Prot, or delete infected files 
 
 General Comments: 
       The Amstrad virus was first reported in November, 1989, by Jean Luz 
       of Portugal; however, it has been known of in Spain and Portugal for 
       a year prior to that.  The virus is a generic .COM infector, but is 
       not memory resident.  It will infect COMMAND.COM.  It is based on 
       the Pixel virus. 
 
       When a program infected with Amstrad is executed, the Amstrad virus 
       will infect three .COM files, located in the current directory. 
       Infected files not have a file length increase as they will have been 
       overwritten by the viral code. 
 
       The virus carries a fake advertisement for the Amstrad computer: 
  
          "=!= Buy AMSTRAD it is THE CHEAPEST COMPUTER that you can buy" 
 
       The Amstrad virus doesn't do anything besides replicate. 
 
       Known variant(s) of Amstrad are: 
       Amstrad-End Is Near: The Amstrad-End Is Near variant is very 
               similar to the original Amstrad virus.  The major difference 
               is that the text strings have been changed to: 
               "=!= THE END IS NEAR!! 
                THE SIGNS OF THE BEAST ARE EVERYWHERE" 
               The first .COM file in the current directory will increase 
               in size by 847 bytes when it is infected.  Other .COM files 
               will not have a file length increase as the virus will 
               overwrite part of the host program. 
               Origin:  Unknown  1990 
       Amstrad-End Is Near B: This variant is a very minor variant of the 
               Amstrad-End Is Near virus.  It infects the first five .COM 
               files in the current directory when an infected program is 
               executed.  Infected programs will have a file length increase 
               of 847 bytes with the virus being located at the beginning of 
               the file.  It contains the same text strings as the original 
               End Is Near variant. 
               Origin:  Unknown  January, 1994. 
       Amstrad-Luz: The Amstrad-Luz variant is very similar to the 
               original Amstrad virus.  The text strings have been 
               changed to: 
               "=!= Hello, John Mcafee,please uprade me. 
                Bests regards,Jean Luz" 
               Origin:  Portugal  November, 1989 
 
       See:   Hell   Pixel   Silly   Silly-365

Show viruses from discovered during that infect .

Main Page