Peace Man Virus

 Virus Name:  Peace Man 
 V Status:    Rare 
 Discovered:  September, 1993 
 Symptoms:    .EXE file growth; file date/time changes; 
              decrease in total system & available free memory 
 Origin:      The Netherlands 
 Eff Length:  2,066 - 2,080 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, AVTK, Sweep, NAV, IBMAV, F-Prot, 
                    NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, NAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Peace Man virus was submitted in September, 1993, and is from 
       The Netherlands.  It is a memory resident infector of .EXE programs. 
       When the first Peace Man infected program is executed, this virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 2,592 bytes.  Interrupts 21 and 22 
       will be hooked by Peace Man in memory. 
       Once memory resident, the Peace Man virus will infect .EXE programs 
       when they are executed.  Infected programs will have a file length 
       increase of 2,066 to 2,080 bytes with the virus being located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will have been updated to the current system date 
       and time when infection occurred.  The following text strings are 
       visible within the viral code in all Peace Man infected programs: 
               "aaaag pappie" 
               "peace man, peace !!!!" 
       The last text string, "GG", can be found at the very end of all 
       infected programs. 
       It is unknown what Peace Man does besides replicate. 

Show viruses from discovered during that infect .

Main Page