Virus Name: Shake
Aliases: Shake Dropper
V Status: Rare
Discovered: May, 1990
Symptoms: .COM growth; message; change in COMMAND.COM memory allocation
Eff Length: 476 Bytes
Type Code: PRCK - Resident Parasitic .COM Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Shake virus was first isolated in Bulgaria in May, 1990 by
Daniel Kalchev. It is a memory resident generic .COM infector, and
will infect COMMAND.COM.
The first time an infected program is executed, the Shake virus
will install itself memory resident, altering the image of
COMMAND.COM in memory.
The Shake virus infects .COM files, infecting them as they are
accessed. Infected files increase in size by 476 Bytes, though the
size increase cannot be seen using a DIR (list directory) command
if the virus is memory resident.
While the virus is not destructive, it will occasionally display
the message: "Shake well before use !" when an infected file is
attempted to be run. When this message is displayed, the program
terminates rather than executes. A second attempt to run the same
program result in it running successfully.
Known variant(s) of Shake are:
Shake Dropper: A small .EXE program which drops the Shake virus
Origin: Bulgaria, May, 1990