Phantom Virus

 Virus Name:  Phantom 
 V Status:    Rare 
 Discovered:  January, 1991 
 Symptoms:    .COM growth; message; shift of system display; decrease in 
              total system and available memory 
 Origin:      Hungary 
 Eff Length:  2,274 Bytes 
 Type Code:   PRhC - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Phantom virus was isolated in Hungary in January, 1991, by Dr. 
       Szegedi Imre.  This virus is a memory resident infector of .COM 
       files, but not COMMAND.COM. 
       The first time a program infected with the Phantom virus is 
       executed, the Phantom virus will install itself memory resident at 
       the top of system memory but below the 640K DOS boundary.  Infected 
       systems will have interrupts 20 and 21 hooked by the virus, and the 
       DOS CHKDSK program will report total system and available memory as 
       2,704 bytes less than expected. 
       After becoming memory resident, the Phantom virus will infect .COM 
       programs as they are executed or opened if the original file length 
       is greater than 2K.  Infected programs will increase in size by 
       2,274 bytes with the virus being located at the end of infected 
       Systems infected with the Phantom virus will experience the 
       following message being displayed intermittently when programs are 
               "HI ROOKIE! 
                I`m a THESEASE! I live in YOUR computer - sorry... 
                Thanks to Brains in the Computer Siences!" 
       This message, as with the following text strings which also occur 
       in the virus's code, cannot be seen in infected programs as they 
       are encrypted.  The other text strings which are encrypted in the 
       viral code are: 
               "The PHANTOM Was HERE - SORRY" 
               "(c) PHANTOM  -  This virus was designed in the HUNGARIAN 
                VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0" 
       Another symptom of the Phantom virus is that it will occasionally 
       alter the system display so that what should start on the left side 
       of the screen starts in the middle (it is shifted 50% with wrap 
       around on the same line). 

Show viruses from discovered during that infect .

Main Page