Sandwich Virus

 Virus Name:  Sandwich 
 V Status:    Rare 
 Discovery:   October, 1992 
 Symptoms:    .COM file growth; decrease in total system & available free 
              memory; messages; system hangs; file allocation errors 
 Origin:      Manchester, England 
 Eff Length:  1,172 Bytes 
 Type Code:   PRhC - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Sandwich virus was received in October, 1992, from Manchester, 
       England.  Sandwich is a memory resident infector of .COM programs. 
       It displays messages requiring a user response in a manner similar 
       to the Ear virus.  It does not infect COMMAND.COM. 
       The first time a program infected with the Sandwich virus is 
       executed, the Sandwich virus will install itself memory resident 
       at the top of system memory but below the 640K DOS boundary.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 3,008 bytes.  Interrupt 21 will be 
       hooked by the Sandwich virus is memory. 
       Once memory resident, the Sandwich virus will infect .COM programs 
       when they are executed or opened for any reason.  Infected programs 
       will increase in length by 1,172 bytes with the initial infection, 
       though the file length increase will not be visible if the virus is 
       memory resident.  The virus will be located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       not be altered. 
       Approximately one out of every six program executions will result 
       in the Sandwich virus displaying a message requiring a user 
       response.  The message is: 
               "Which ARCV Member Likes a  Sandwich? 
                Is it A. Apache Warrior 
                      B. ICE-9 
                      C. Slartibartfast 
                Select a Letter: " 
       The "" text above will be one of the following: 
               "Cheese, Beef Spread, Cucumber and Crisp" 
               "Corned Beef and Salad Cream" 
               "Jaffa Cake and Hamster on Rye" 
       If the user answers the question correctly, the virus will display 
       the following text, and the program the user was attempting to 
       execute will run: 
               "Well you know you`re ARCV Members." 
       If the user answers the question incorrectly, the virus will display 
       the following text, and a system hang may occur: 
               "Bad Luck.. Better Luck Next Time." 
       All of the above text is encrypted within the viral code, and thus 
       not visible in infected programs.  The answers for the questions, 
       based on the sandwich types in the order indicated above, are A, 
       B, and then C. 
       Systems infected with the Sandwich virus will also notice file 
       allocation errors being detected on all infected files when the 
       Sandwich virus is memory resident. 

Show viruses from discovered during that infect .

Main Page