Sandwich Virus

Virus Name: Sandwich Aliases: V Status: Rare Discovery: October, 1992 Symptoms: .COM file growth; decrease in total system & available free memory; messages; system hangs; file allocation errors Origin: Manchester, England Eff Length: 1,172 Bytes Type Code: PRhC - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Sandwich virus was received in October, 1992, from Manchester, England. Sandwich is a memory resident infector of .COM programs. It displays messages requiring a user response in a manner similar to the Ear virus. It does not infect COMMAND.COM. The first time a program infected with the Sandwich virus is executed, the Sandwich virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 3,008 bytes. Interrupt 21 will be hooked by the Sandwich virus is memory. Once memory resident, the Sandwich virus will infect .COM programs when they are executed or opened for any reason. Infected programs will increase in length by 1,172 bytes with the initial infection, though the file length increase will not be visible if the virus is memory resident. The virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. Approximately one out of every six program executions will result in the Sandwich virus displaying a message requiring a user response. The message is: "Which ARCV Member Likes a Sandwich? Is it A. Apache Warrior B. ICE-9 C. Slartibartfast Select a Letter: " The "" text above will be one of the following: "Cheese, Beef Spread, Cucumber and Crisp" "Corned Beef and Salad Cream" "Jaffa Cake and Hamster on Rye" If the user answers the question correctly, the virus will display the following text, and the program the user was attempting to execute will run: "Well you know you`re ARCV Members." If the user answers the question incorrectly, the virus will display the following text, and a system hang may occur: "Bad Luck.. Better Luck Next Time." All of the above text is encrypted within the viral code, and thus not visible in infected programs. The answers for the questions, based on the sandwich types in the order indicated above, are A, B, and then C. Systems infected with the Sandwich virus will also notice file allocation errors being detected on all infected files when the Sandwich virus is memory resident.