Virus Name: Psychosis
V Status: Rare
Discovery: February, 1994
Symptoms: .COM file growth; messages
Eff Length: 1,202 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: AVTK, IBMAV, ViruScan, Sweep, F-Prot, NAV,
NAVDX, VAlert, ChAV,
NProt, AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N, LProt,
Removal Instructions: Delete infected files
The Psychosis virus was received in February, 1994, and appears to
be from Sweden. It is a non-resident, direct action infector of
.COM programs, but not COMMAND.COM.
When a program infected with the Psychosis virus is executed, the
Psychosis virus will infect three .COM programs, though not in the
current directory. Typically, the programs infected by the virus
will be located in a directory directly above or below the current
directory in the directory structure. Programs infected with the
Psychosis virus will have a file length increase of 1,202 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the Psychosis viral
"\ *.com *.* .."
"\\ Merry Xmas and a happy new year //
Sweden - Snowing Again"
"Another year passed by"
"Another tear the willows cry"
"to change the world we ever try"
"to make a difference before we die"
"(c) 93/94 The Unforgiven / Immortal Riot"
This virus activates when the first infected program is executed on
June 6th of any year. When this even occurs, the virus will install
a 704 byte TSR, hooking interrupt 08. Once the TSR is installed,
the virus will display the message contained above in text strings
4 - 9. The display occurs every few minutes at the top of the system
display with a dozen or so characters being added to the message at a