Virus Name: Sandwich
V Status: Rare
Discovery: October, 1992
Symptoms: .COM file growth; decrease in total system & available free
memory; messages; system hangs; file allocation errors
Origin: Manchester, England
Eff Length: 1,172 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The Sandwich virus was received in October, 1992, from Manchester,
England. Sandwich is a memory resident infector of .COM programs.
It displays messages requiring a user response in a manner similar
to the Ear virus. It does not infect COMMAND.COM.
The first time a program infected with the Sandwich virus is
executed, the Sandwich virus will install itself memory resident
at the top of system memory but below the 640K DOS boundary. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 3,008 bytes. Interrupt 21 will be
hooked by the Sandwich virus is memory.
Once memory resident, the Sandwich virus will infect .COM programs
when they are executed or opened for any reason. Infected programs
will increase in length by 1,172 bytes with the initial infection,
though the file length increase will not be visible if the virus is
memory resident. The virus will be located at the end of the file.
The program's date and time in the DOS disk directory listing will
not be altered.
Approximately one out of every six program executions will result
in the Sandwich virus displaying a message requiring a user
response. The message is:
"Which ARCV Member Likes a