Shark Virus
Virus Name: Shark
Aliases: Shark.1283
V Status: New
Discovered: July, 1995
Symptoms: .EXE file growth; decrease in available free memory
Origin: Unknown, possibly Italy
Eff Length: 1,283 - 1,297 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, AVTK, VAlert, NAVDX, Sweep, ViruScan, NAV,
IBMAV, PCScan,
Sweep/N, NShld, NAV/N, IBMAV/N, AVTK/N, NProt, LProt
Removal Instructions: Delete infected files
General Comments:
The Shark or Shark.1283 virus was received in July, 1995. Its
origin or point of isolation is unknown, though it appears it may
be from Italy. Shark is a memory resident infector of .EXE files.
When the first Shark infected program is executed, this virus will
install itself memory resident at the top of system memory but below
the 640K DOS boundary, not moving interrupt 12's return. Available
free memory, as indicated by the DOS CHKDSK program from DOS 5.0,
will have decreased by 1,120 bytes. Interrupt 21 will be hooked by
the virus in memory.
Once the Shark virus is memory resident, it will infect .EXE files
when they are executed, adding 1,283 to 1,297 bytes to the host
file's length. The virus will be located at the end of the file.
The program's date and time in the DOS disk directory listing will
not be altered. The following text strings are visible within the
viral code in all infected programs:
"Made in Italy"
"I will kiss Nadia's lips..."
"Prince&NPG"
"Billy Idol"
"The Tiny Shark II was here...Happy Birthday Nadia!"
It is unknown what the Shark virus may do besides replicate.
Known variant(s) of Shark are:
Shark.1661: Also received in July, 1995, this is a 1,661 byte
variant of the Shark virus described above. Its size in memory
is 4,000 bytes, hooking interrupt 21. It adds 1,661 to 1,675
bytes to the .EXE files it infectes. The virus will be located
at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The following
text strings are visible within the viral code:
"The Trickster"
"The Trickster Virus version 1.1beta"
"This virus was written in the city of RC Italy"
Origin: Unknown July, 1995.
E