Virus Name: Possum
V Status: Viron
Discovered: February, 1992
Symptoms: .COM files overwritten/corrupted; message displayed
Eff Length: 202 Bytes
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Possum virus was submitted in February, 1992. Its origin or
point of isolation is unknown. Possum is a non-resident, direct
action overwriting virus which infects .COM programs, including
When a program infected with the Possum virus is executed, this
virus will infect the first previously uninfected .COM program
in encounters in the current directory, overwriting the first
202 bytes of the host program with the virus. Since the first
202 bytes of the host are overwritten, the program will be
permanently corrupted and no longer function properly. Programs
infected with Possum will have no file length increase, unless
their original file length was less than 202 bytes, in which case
the program will become 202 bytes in length. The file's date and
time in the DOS disk directory listing will not be altered.
The following text strings can be found in all programs infected
with the Possum virus:
"IN HASTINGS addr error D9EB, 02"
"*.COM WOLVERINE v1.01"
"by Nick(ie) Haflinger"
Once the Possum virus has infected all of the .COM programs in
the current directory, execution of an infected program will result
in a message being displayed:
"I AM 'xxxxxxxxxxxx' IN HASTINGS addr error D9EB,02"
The 'xxxxxxxxxxxx' will contain a group of garbled characters.
Possum doesn't do anything besides replicate and display its