Possum Virus

Virus Name: Possum Aliases: V Status: Viron Discovered: February, 1992 Symptoms: .COM files overwritten/corrupted; message displayed Origin: Unknown Eff Length: 202 Bytes Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Possum virus was submitted in February, 1992. Its origin or point of isolation is unknown. Possum is a non-resident, direct action overwriting virus which infects .COM programs, including COMMAND.COM. When a program infected with the Possum virus is executed, this virus will infect the first previously uninfected .COM program in encounters in the current directory, overwriting the first 202 bytes of the host program with the virus. Since the first 202 bytes of the host are overwritten, the program will be permanently corrupted and no longer function properly. Programs infected with Possum will have no file length increase, unless their original file length was less than 202 bytes, in which case the program will become 202 bytes in length. The file's date and time in the DOS disk directory listing will not be altered. The following text strings can be found in all programs infected with the Possum virus: "IN HASTINGS addr error D9EB, 02" "*.COM WOLVERINE v1.01" "by Nick(ie) Haflinger" Once the Possum virus has infected all of the .COM programs in the current directory, execution of an infected program will result in a message being displayed: "I AM 'xxxxxxxxxxxx' IN HASTINGS addr error D9EB,02" The 'xxxxxxxxxxxx' will contain a group of garbled characters. Possum doesn't do anything besides replicate and display its message. See: Hastings