Shark Virus


 Virus Name:  Shark 
 Aliases:     Shark.1283 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .EXE file growth; decrease in available free memory 
 Origin:      Unknown, possibly Italy 
 Eff Length:  1,283 - 1,297 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  F-Prot, AVTK, VAlert, NAVDX, Sweep, ViruScan, NAV, 
                    IBMAV, PCScan, 
                    Sweep/N, NShld, NAV/N, IBMAV/N, AVTK/N, NProt, LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Shark or Shark.1283 virus was received in July, 1995.  Its 
       origin or point of isolation is unknown, though it appears it may 
       be from Italy.  Shark is a memory resident infector of .EXE files. 
 
       When the first Shark infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Available 
       free memory, as indicated by the DOS CHKDSK program from DOS 5.0, 
       will have decreased by 1,120 bytes.  Interrupt 21 will be hooked by 
       the virus in memory. 
 
       Once the Shark virus is memory resident, it will infect .EXE files 
       when they are executed, adding 1,283 to 1,297 bytes to the host 
       file's length.  The virus will be located at the end of the file. 
       The program's date and time in the DOS disk directory listing will 
       not be altered.  The following text strings are visible within the 
       viral code in all infected programs: 
 
           "Made in Italy" 
           "I will kiss Nadia's lips..." 
           "Prince&NPG" 
           "Billy Idol" 
           "The Tiny Shark II was here...Happy Birthday Nadia!" 
 
       It is unknown what the Shark virus may do besides replicate. 
 
       Known variant(s) of Shark are: 
       Shark.1661: Also received in July, 1995, this is a 1,661 byte 
           variant of the Shark virus described above.  Its size in memory 
           is 4,000 bytes, hooking interrupt 21.  It adds 1,661 to 1,675 
           bytes to the .EXE files it infectes.  The virus will be located 
           at the end of the file.  The program's date and time in the 
           DOS disk directory listing will not be altered.  The following 
           text strings are visible within the viral code: 
           "The Trickster" 
           "The Trickster Virus version 1.1beta" 
           "This virus was written in the city of RC Italy" 
           Origin:  Unknown  July, 1995. 
 
 
 E 

Show viruses from discovered during that infect .

Main Page