Virus Name: Phantom
V Status: Rare
Discovered: January, 1991
Symptoms: .COM growth; message; shift of system display; decrease in
total system and available memory
Eff Length: 2,274 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Phantom virus was isolated in Hungary in January, 1991, by Dr.
Szegedi Imre. This virus is a memory resident infector of .COM
files, but not COMMAND.COM.
The first time a program infected with the Phantom virus is
executed, the Phantom virus will install itself memory resident at
the top of system memory but below the 640K DOS boundary. Infected
systems will have interrupts 20 and 21 hooked by the virus, and the
DOS CHKDSK program will report total system and available memory as
2,704 bytes less than expected.
After becoming memory resident, the Phantom virus will infect .COM
programs as they are executed or opened if the original file length
is greater than 2K. Infected programs will increase in size by
2,274 bytes with the virus being located at the end of infected
Systems infected with the Phantom virus will experience the
following message being displayed intermittently when programs are
I`m a THESEASE! I live in YOUR computer - sorry...
Thanks to Brains in the Computer Siences!"
This message, as with the following text strings which also occur
in the virus's code, cannot be seen in infected programs as they
are encrypted. The other text strings which are encrypted in the
viral code are:
"The PHANTOM Was HERE - SORRY"
"(c) PHANTOM - This virus was designed in the HUNGARIAN
VIRUS DEVELOPING LABORATORY. (H.V.D.L.) v1.0"
Another symptom of the Phantom virus is that it will occasionally
alter the system display so that what should start on the left side
of the screen starts in the middle (it is shifted 50% with wrap
around on the same line).