Poem Virus
Virus Name: Poem
Aliases: ACDC
V Status: Rare
Discovered: September, 1991
Symptoms: .COM growth; message displayed; hard disk corruption
Origin: Republic of South Africa
Eff Length: 1,825 - 1,888 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N,
AVTK/N, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Poem virus was isolated in the Republic of South Africa in
September, 1991, by Oliver Steudler. Poem is a memory resident
infector of .COM programs, including COMMAND.COM.
The first time a program infected with Poem is executed, the virus
will become memory resident in low available system memory.
Interrupts 01, 03, 21, and 7C will have been hooked by the Poem
virus in memory.
Once Poem is memory resident, it will infect .COM programs, other
than very small .COM programs, when they are executed. If
COMMAND.COM is executed, it will become infected as well. Poem
infected programs will have a file size increase of approximately
1,825 to 1,888 bytes with the virus being located at the end of
the infected file. There will be no change to the file's date and
time in the DOS disk directory.
The copy of Poem resident in memory keeps track of how many times
interrupt 21 has been called. Once interrupt 21 has been called
2,112 time, the virus will display the following poem on the
system display, and the user will be prompted to press Escape to
continue:
"Void - Composed by Marvin Giskard for T....
In a field a million buds stood,Over them a million days
came - a day a bud - opening up one by one with their
directed light.But one didn't do as others did,It waited
for only your loving rays to shine upon it to open its
pedals revealing the pure beauty of its sincere love.
Never being unfaithful to its dream of the day of your
light, Forced to resist any other light but yours -
because of it - until the day the brilliance of your
life sustaining light shines it will be there : wanting,
wishing, waiting. Many were the buds you rather shined
upon opening them - revealing their phony colours. I
willed your light onto me but others you tried instead,
No subtle motion reached you, still I refused other's
light - holding out for you - Even when your light will
fade, Not having found one to do your light justice,
mine will still be there : wanting, wishing, waiting.
22 Nov - 21 Dec"
On December 21 of any year, Poem will activate. At that time, the
virus will also display the above poem, as well as overwrite the
first 1,221 sectors of the system hard disk, drive C:, with an
unencrypted copy of the virus' code.