Sayha Watpu Virus


 Virus Name:  Sayha Watpu 
 Aliases:     SW Error V2f 
 V Status:    Rare 
 Discovered:  September, 1993 
 Symptoms:    .COM & .EXE growth; TSR 
 Origin:      Unknown 
 Eff Length:  4,000 Bytes 
 Type Code:   PRsAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, NAV, AVTK, IBMAV, Sweep, NAVDX, 
                    VAlert, PCScan, ChAV, 
                    NShld, NAV/N, Sweep/N, IBMAV/N, AVTK/N, NProt, Innoc, 
                    LProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Sayha Watpu, or SW Error V2f, virus was submitted in September, 
       1993.  Its origin or point of isolation is unknown.  Sayha Watpu is 
       a memory resident infector of .COM and .EXE programs, including 
       COMMAND.COM.  It is a fast infector, quickly spreading on infected 
       systems. 
 
       When the first Sayha Watpu infected program is executed, this virus 
       will install itself memory resident as a low system memory TSR of 
       9,824 bytes.  Interrupts 16 and 21 will be hooked by the virus in 
       memory. 
 
       Once the Sayha Watpu virus is memory resident, it will infect .COM 
       and .EXE programs, including COMMAND.COM, when they are executed or 
       opened for any reason.  Infected programs will have a file length 
       increase of 4,000 bytes with the virus being located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text string is visible 
       within all Sayha Watpu infected programs: 
 
               "SW Error  V2f Sayha Watpu" 
 
       It is unknown what Sayha Watpu may do besides replicate. 

Show viruses from discovered during that infect .

Main Page