Select Virus


 Virus Name:  Select 
 Aliases:     Select.1112 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .EXE file growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  1,112 Bytes 
 Type Code:   PRtE - Parasitic Resident .EXE Infector 
 Detection Method: F-Prot, AVTK, VAlert, ViruScan, Sweep, NAVDX, NAV, 
                   IBMAV, PCScan, ChAV, 
                   NShld, Sweep/N, NAV/N, IBMAV/N, AVTK/N, NProt, LProt, 
                   Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Select or Select.1112 virus was received in July, 1995, along 
       with one variant, Select.1258.  Select is a memory resident infector 
       of .EXE files. 
 
       When the first Select infected program is executed, this virus will 
       install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program from DOS 5.0, will have decreased by 2,048 bytes.  Interrupts 
       08, 09, and 21 will be hooked by the virus in memory. 
 
       Once the Select virus is memory resident, it will infect .EXE files 
       when they are executed.  Infected .EXE files will have a file 
       length increase of 1,112 bytes with the virus being located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text string 
       is visible within the viral code: 
 
           "(C) Selectronics Software" 
 
       It is unknown what the Select virus may do besides replicate. 
 
       Known variant(s) of Select are: 
       Select.1258: Also received in July, 1995, this is a 1,258 byte 
           variant of the Select virus described above.  Its size in 
           memory is 2,896 bytes, hooking interrupts 10, 1C, and 21.  It 
           does not move interrupt 12's return.  Once resident, it infects 
           .EXE files when they are executed or opened, but not when 
           copied.  Infected programs will have a file length increase of 
           1,258 bytes with the virus being located at the end of the 
           file.  The program's date and time in the DOS disk directory 
           listing will not be altered.  The following text string is 
           visible within the viral code: 
           "Digouter 05/05/91 (C) Selectronics Software" 
           This variant may emit sound from the system speaker which is 
           a tone moving up the sound scale after some programs are 
           executed. 
           Origin:  Unknown  July, 1995. 

Show viruses from discovered during that infect .

Main Page