Phantom Virus

Virus Name: Phantom Aliases: V Status: Rare Discovered: January, 1991 Symptoms: .COM growth; message; shift of system display; decrease in total system and available memory Origin: Hungary Eff Length: 2,274 Bytes Type Code: PRhC - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Phantom virus was isolated in Hungary in January, 1991, by Dr. Szegedi Imre. This virus is a memory resident infector of .COM files, but not COMMAND.COM. The first time a program infected with the Phantom virus is executed, the Phantom virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Infected systems will have interrupts 20 and 21 hooked by the virus, and the DOS CHKDSK program will report total system and available memory as 2,704 bytes less than expected. After becoming memory resident, the Phantom virus will infect .COM programs as they are executed or opened if the original file length is greater than 2K. Infected programs will increase in size by 2,274 bytes with the virus being located at the end of infected programs. Systems infected with the Phantom virus will experience the following message being displayed intermittently when programs are executed: "HI ROOKIE! I`m a THESEASE! I live in YOUR computer - sorry... Thanks to Brains in the Computer Siences!" This message, as with the following text strings which also occur in the virus's code, cannot be seen in infected programs as they are encrypted. The other text strings which are encrypted in the viral code are: "The PHANTOM Was HERE - SORRY" "(c) PHANTOM - This virus was designed in the HUNGARIAN VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0" Another symptom of the Phantom virus is that it will occasionally alter the system display so that what should start on the left side of the screen starts in the middle (it is shifted 50% with wrap around on the same line).