PMT Virus

 Virus Name:  PMT 
 Aliases:     PMT.867 
 V Status:    New 
 Discovered:  January, 1996 
 Symptoms:    TSR; hidden .COM files created; system hangs 
 Origin:      Unknown 
 Eff Length:  867 Bytes 
 Type Code:   SRsE - Spawning/Companion Resident .EXE Infector 
 Detection Method: ChAV, F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, 
                   Innoc, AVTK/N, IBMAV/N, NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The PMT or PMT.867 virus was received in January, 1996.  Its origin 
       or point of isolation is unknown.  PMT is a memory resident 
       encrypted virus which infects .EXE files by creating companion 
       .COM files. 
       When the first PMT infected program is executed, this virus will 
       install itself memory resident as a low system memory TSR of 
       3,904 bytes.  Interrupt 21 will be hooked by the virus in memory. 
       Once the PMT virus is memory resident, it will infect .EXE files 
       when they are executed by creating a hidden, read-only companion 
       .COM file with the same base file name.  These hidden, read-only 
       .COM files will be 867 bytes in length and contain the viral 
       code of the virus.  The file's date and time will be the system 
       date and time when infection occurred.  The following text string 
       is visible within the viral code: 
           "CRYPTO-KING v1.0" 
       The following text strings are encrypted within the viral code: 
            "Anke Huber for Ever" 
            "Fuck John McAfee" 
            "Eat my Butterfly" 
            "Suck her Spinkta muscle" 
            "Bruce Sterlin; I'd like to sho-d" 
            "BaBCxan accent down ya throat" 
            "Oprah Winfrey sings AC/DC's classic PMT" 
            "I've got PMT" 
            "But I'll win the fight" 
            "I'm a powerload" 
            "Just watch me explode" 
            "The funky dyin' brain cell" 
       System hangs may occur when infected programs are executed. 

Show viruses from discovered during that infect .

Main Page