Raving Virus

Virus Name: Raving Aliases: V Status: New Discovery: July, 1995 Symptoms: HUNDRED.COM file created; disrupts keyboard input Origin: Unknown Eff Length: 2,300 Bytes Type Code: SNC - Spawning Non-Resident .COM Infector Detection Method: F-Prot, AVTK, VAlert, Sweep, IBMAV, ViruScan, NAV, NAVDX, ChAV, Sweep/N, IBMAV/N, NShld, NAV/N, AVTK/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Raving virus was received in July, 1995. Its origin or point of isolation is unknown. Raving is a non-resident companion or spawning virus which infects by creating new .COM files. When a program infected with the Raving virus is executed, this virus will create a file named "HUNDRED.COM" in the current directory,if the file previously existed, it will be overwritten with the viral code. The "HUNDRED.COM" file will have a file length of 2,300 bytes and contain pure viral code. Its file date and time in the DOS disk directory listing will be the current system date and time when the file was created. The following text strings are visible within the viral code: "COMMAND.COM" "*.com command.com" "HUNDRED.COM" "C:\>" "I DON'T THINK YOU WOULD LIKE TO SMILE, BECAUSE I HAVE INFECTED A FILE!!! HAVE YOU HEARD OF A RAVING VIRUS MC, YES YOU GUESSED IT THAT IS ME!!! YOU WONT SEE ANOTHER RHYME UNTIL IT IS INFECTING TIME!!!" If the system user was not previously in the C: drive root directory, the virus will leave the user at the system prompt in that directory. Once this has occurred, all characters typed on the system keyboard will be jibberish and unreadable or executable.