PMT Virus

Virus Name: PMT Aliases: PMT.867 V Status: New Discovered: January, 1996 Symptoms: TSR; hidden .COM files created; system hangs Origin: Unknown Eff Length: 867 Bytes Type Code: SRsE - Spawning/Companion Resident .EXE Infector Detection Method: ChAV, F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, Innoc, AVTK/N, IBMAV/N, NShld, NAV/N Removal Instructions: Delete infected files General Comments: The PMT or PMT.867 virus was received in January, 1996. Its origin or point of isolation is unknown. PMT is a memory resident encrypted virus which infects .EXE files by creating companion .COM files. When the first PMT infected program is executed, this virus will install itself memory resident as a low system memory TSR of 3,904 bytes. Interrupt 21 will be hooked by the virus in memory. Once the PMT virus is memory resident, it will infect .EXE files when they are executed by creating a hidden, read-only companion .COM file with the same base file name. These hidden, read-only .COM files will be 867 bytes in length and contain the viral code of the virus. The file's date and time will be the system date and time when infection occurred. The following text string is visible within the viral code: "CRYPTO-KING v1.0" The following text strings are encrypted within the viral code: "Anke Huber for Ever" "AP.CC.DV.EV.DF.T2T.TC.M.SR.RA" "Fuck John McAfee" "Eat my Butterfly" "Suck her Spinkta muscle" "Bruce Sterlin; I'd like to sho-d" "BaBCxan accent down ya throat" "Oprah Winfrey sings AC/DC's classic PMT" "I've got PMT" "PMT" "But I'll win the fight" "PMT" "I'm a powerload" "PMT" "Just watch me explode" "The funky dyin' brain cell" System hangs may occur when infected programs are executed.