Self Virus

Virus Name: Self Aliases: Polish-457, Polish-550, Self-457, Self-550 V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; file date/time change Origin: Poland Eff Length: 457 or 550 bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, NAV, F-Prot, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Self virus is actually two viruses which were received from Europe in November, 1991. They originated in Poland. Both viruses are non-resident direct action infectors of .COM programs, including COMMAND.COM. When a program infected with one of the Self viruses is executed, the virus will search the current directory to find all previously uninfected .COM programs. All uninfected programs found will become infected with the Self virus. The file length increase will be either 457 or 550 bytes, depending on which of the two viruses is present, with the virus being located at the beginning of the infected file. In either case, the infected file's date and time in the DOS directory will have been updated to the current system date and time when infection occurred. Known variant(s) of Self are: Self-457: The 457 byte version of the Self virus. Infected files will have increased in size by 457 bytes. The following text strings can be found in infected programs: "MS *.COM" and "RZRZ". This variant is also known as Polish-457. Self-550: The 550 byte version of the Self virus. Infected files will have increased in size by 550 bytes. The following text strings can be found in infected programs: "CMS*.COM", "*.EXE", and "QYQY". This variant is also known as Polish-550.