Virus Name: PMT
V Status: New
Discovered: January, 1996
Symptoms: TSR; hidden .COM files created; system hangs
Eff Length: 867 Bytes
Type Code: SRsE - Spawning/Companion Resident .EXE Infector
Detection Method: ChAV, F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX,
Innoc, AVTK/N, IBMAV/N, NShld, NAV/N
Removal Instructions: Delete infected files
The PMT or PMT.867 virus was received in January, 1996. Its origin
or point of isolation is unknown. PMT is a memory resident
encrypted virus which infects .EXE files by creating companion
When the first PMT infected program is executed, this virus will
install itself memory resident as a low system memory TSR of
3,904 bytes. Interrupt 21 will be hooked by the virus in memory.
Once the PMT virus is memory resident, it will infect .EXE files
when they are executed by creating a hidden, read-only companion
.COM file with the same base file name. These hidden, read-only
.COM files will be 867 bytes in length and contain the viral
code of the virus. The file's date and time will be the system
date and time when infection occurred. The following text string
is visible within the viral code:
The following text strings are encrypted within the viral code:
"Anke Huber for Ever"
"Fuck John McAfee"
"Eat my Butterfly"
"Suck her Spinkta muscle"
"Bruce Sterlin; I'd like to sho-d"
"BaBCxan accent down ya throat"
"Oprah Winfrey sings AC/DC's classic PMT"
"I've got PMT"
"But I'll win the fight"
"I'm a powerload"
"Just watch me explode"
"The funky dyin' brain cell"
System hangs may occur when infected programs are executed.