RefRef Virus

Virus Name: RefRef Aliases: V Status: Rare Discovery: December, 1992 Symptoms: .EXE file growth; decrease in total system and available free memory Origin: Unknown Eff Length: 1,204 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: F-Prot, ViruScan, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, LProt, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The RefRef virus was submitted in December, 1992. Its origin or point of isolation is unknown. RefRef is a memory resident infector of .EXE programs. When the first RefRef infected program is executed, the RefRef virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,496 bytes. Interrupts 21 and 22 will be hooked by RefRef in memory. Once the RefRef virus is memory resident, it will infect .EXE programs, other than very small ones, when they are executed. Infected programs will have a file length increase of 1,204 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the RefRef viral code: "ReFReF" "TFReF" "4tsonpm" It is unknown what RefRef does besides replicate.