Psychosis Virus

Virus Name: Psychosis Aliases: V Status: Rare Discovery: February, 1994 Symptoms: .COM file growth; messages Origin: Sweden Eff Length: 1,202 Bytes Type Code: PNC - Parasitic Non-Resident .COM Infector Detection Method: AVTK, IBMAV, ViruScan, Sweep, F-Prot, NAV, NAVDX, VAlert, ChAV, NProt, AVTK/N, Sweep/N, IBMAV/N, NShld, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Psychosis virus was received in February, 1994, and appears to be from Sweden. It is a non-resident, direct action infector of .COM programs, but not COMMAND.COM. When a program infected with the Psychosis virus is executed, the Psychosis virus will infect three .COM programs, though not in the current directory. Typically, the programs infected by the virus will be located in a directory directly above or below the current directory in the directory structure. Programs infected with the Psychosis virus will have a file length increase of 1,202 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Psychosis viral code: "\ *.com *.* .." "\\ Merry Xmas and a happy new year // Sweden - Snowing Again" "Another year passed by" "Another tear the willows cry" "to change the world we ever try" "to make a difference before we die" "[PSYCHOSIS]" "Greets, Phalcon/Skism." "(c) 93/94 The Unforgiven / Immortal Riot" This virus activates when the first infected program is executed on June 6th of any year. When this even occurs, the virus will install a 704 byte TSR, hooking interrupt 08. Once the TSR is installed, the virus will display the message contained above in text strings 4 - 9. The display occurs every few minutes at the top of the system display with a dozen or so characters being added to the message at a time.