Play Tetris Virus


 Virus Name:  Play Tetris 
 Aliases:    
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .COM file growth; decrease in total system & available free 
              memory 
 Origin:      Unknown 
 Eff Length:  552 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  Sweep, AVTK, F-Prot, ViruScan, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Play Tetris virus was submitted in December, 1992.  Its origin 
       or point of isolation is unknown.  Play Tetris is a memory resident 
       infector of .COM programs, including COMMAND.COM.  This virus has 
       no relationship to the Tetris game or the Tetris game's author. 
 
       When the first Play Tetris infected program is executed, the Play 
       Tetris virus will install itself memory resident at the top of 
       system memory but below the 640K DOS boundary, hooking interrupt 21. 
       Total system and available free memory, as indicated by the DOS 
       CHKDSK program, will have decreased by 768 bytes.  Interrupt 12's 
       return will not be moved. 
 
       Once the Play Tetris virus is memory resident, it will infect .COM 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 552 bytes with the 
       virus being located at the end of the file.  The program's date and 
       time in the DOS disk directory listing will not be altered.  The 
       following text string can be found within the viral code in all 
       Play Tetris infected programs: 
 
               "PLAY TETRIS,HI-HI-HI..." 

Show viruses from discovered during that infect .

Main Page