Select Virus
Virus Name: Select
Aliases: Select.1112
V Status: New
Discovered: July, 1995
Symptoms: .EXE file growth;
decrease in total system & available free memory
Origin: Unknown
Eff Length: 1,112 Bytes
Type Code: PRtE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, AVTK, VAlert, ViruScan, Sweep, NAVDX, NAV,
IBMAV, PCScan, ChAV,
NShld, Sweep/N, NAV/N, IBMAV/N, AVTK/N, NProt, LProt,
Innoc
Removal Instructions: Delete infected files
General Comments:
The Select or Select.1112 virus was received in July, 1995, along
with one variant, Select.1258. Select is a memory resident infector
of .EXE files.
When the first Select infected program is executed, this virus will
install itself memory resident at the top of system memory but
below the 640K DOS boundary, moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program from DOS 5.0, will have decreased by 2,048 bytes. Interrupts
08, 09, and 21 will be hooked by the virus in memory.
Once the Select virus is memory resident, it will infect .EXE files
when they are executed. Infected .EXE files will have a file
length increase of 1,112 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text string
is visible within the viral code:
"(C) Selectronics Software"
It is unknown what the Select virus may do besides replicate.
Known variant(s) of Select are:
Select.1258: Also received in July, 1995, this is a 1,258 byte
variant of the Select virus described above. Its size in
memory is 2,896 bytes, hooking interrupts 10, 1C, and 21. It
does not move interrupt 12's return. Once resident, it infects
.EXE files when they are executed or opened, but not when
copied. Infected programs will have a file length increase of
1,258 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory
listing will not be altered. The following text string is
visible within the viral code:
"Digouter ¯05/05/91® (C) Selectronics Software"
This variant may emit sound from the system speaker which is
a tone moving up the sound scale after some programs are
executed.
Origin: Unknown July, 1995.