Antimon Virus

Virus Name: Antimon Aliases: V Status: Rare Discovery: November, 1991 Symptoms: .COM file growth Origin: Unknown Eff Length: 1,452 - 1,465 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N, AVTK/N, NAV/N Removal Instructions: Delete infected files General Comments: The Antimon virus was received in November, 1991. Its origin is unknown. Antimon is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with Antimon is executed, the Antimon virus will infect all previously uninfected .COM files located in the C: drive root directory. Since COMMAND.COM normally resides in this directory, it will be infected as well. Antimon infected files increase in size by 1,452 to 1,465 bytes. The virus will be located at the end of all infected files. There will be no change in the file's date and time in a DOS disk directory listing. The following text strings will be found within the viral code of Antimon infected programs: "*.com" "????????COM" "FLUSHOT3.COM" "C:\PANDA\MONITOR.COM TSRMON.COM TSRMONEZ.COM" "= C:\PDPROG" It is unknown what Antimon does besides replicate. See: 1452