Peace Man Virus

Virus Name: Peace Man Aliases: V Status: Rare Discovered: September, 1993 Symptoms: .EXE file growth; file date/time changes; decrease in total system & available free memory Origin: The Netherlands Eff Length: 2,066 - 2,080 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, AVTK, Sweep, NAV, IBMAV, F-Prot, NAVDX, VAlert, ChAV, NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Peace Man virus was submitted in September, 1993, and is from The Netherlands. It is a memory resident infector of .EXE programs. When the first Peace Man infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,592 bytes. Interrupts 21 and 22 will be hooked by Peace Man in memory. Once memory resident, the Peace Man virus will infect .EXE programs when they are executed. Infected programs will have a file length increase of 2,066 to 2,080 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings are visible within the viral code in all Peace Man infected programs: "aaaag pappie" "peace man, peace !!!!" "GG" The last text string, "GG", can be found at the very end of all infected programs. It is unknown what Peace Man does besides replicate.