Peace Man Virus
Virus Name: Peace Man
V Status: Rare
Discovered: September, 1993
Symptoms: .EXE file growth; file date/time changes;
decrease in total system & available free memory
Origin: The Netherlands
Eff Length: 2,066 - 2,080 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, NAV, IBMAV, F-Prot,
NAVDX, VAlert, ChAV,
NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, NAV/N, Innoc
Removal Instructions: Delete infected files
The Peace Man virus was submitted in September, 1993, and is from
The Netherlands. It is a memory resident infector of .EXE programs.
When the first Peace Man infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 2,592 bytes. Interrupts 21 and 22
will be hooked by Peace Man in memory.
Once memory resident, the Peace Man virus will infect .EXE programs
when they are executed. Infected programs will have a file length
increase of 2,066 to 2,080 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will have been updated to the current system date
and time when infection occurred. The following text strings are
visible within the viral code in all Peace Man infected programs:
"peace man, peace !!!!"
The last text string, "GG", can be found at the very end of all
It is unknown what Peace Man does besides replicate.