Virus Name: RefRef
V Status: Rare
Discovery: December, 1992
Symptoms: .EXE file growth; decrease in total system and available free
Eff Length: 1,204 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, ViruScan, Sweep, AVTK, NAV, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, LProt, NAV/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The RefRef virus was submitted in December, 1992. Its origin or
point of isolation is unknown. RefRef is a memory resident infector
of .EXE programs.
When the first RefRef infected program is executed, the RefRef virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 2,496 bytes. Interrupts 21 and 22 will be hooked by RefRef in
Once the RefRef virus is memory resident, it will infect .EXE
programs, other than very small ones, when they are executed.
Infected programs will have a file length increase of 1,204 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the RefRef viral
It is unknown what RefRef does besides replicate.