Shield Virus

 Virus Name:  Shield 
 V Status:    Rare 
 Discovered:  March, 1992 
 Symptoms:    .COM file growth; hidden .COM files created; file date/time 
              change; TSR; system hangs 
 Origin:      Unknown 
 Eff Length:  5,152 Bytes (companion files), 127 Bytes .COM 
 Type Code:   PSRsA - Parasitic Spawning Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, Sweep, NAV, NAVDX, VAlert, PCScan, 
                    IBMAV, F-Prot, ChAV, 
                    NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Shield virus was received in March, 1992.  Its origin is 
       unknown.  This virus is a memory resident spawning or companion 
       virus which infects .EXE programs by creating corresponding .COM 
       files.  It also adds 127 bytes to .COM programs other than 
       COMMAND.COM, though these files do not carry an active viral 
       The first time a program infected with Shield is executed, the 
       Shield virus will install itself memory resident as a low system 
       memory TSR of 5,456 bytes.  Interrupt 21 will be hooked. 
       Once the Shield virus is memory resident, it will create a hidden 
       companion .COM file of 5,152 bytes for each .EXE program which 
       is executed or opened.  It will also add 127 bytes of code to 
       each .COM program which is executed or opened.  The 127 bytes of 
       additional code is added to the end of .COM programs, and the 
       file's date and time in the DOS disk directory listing will 
       have been updated. 
       The Shield virus is creates an active infection only in the 
       companion, hidden .COM programs. 
       System hangs may occur on infected systems. 

Show viruses from discovered during that infect .

Main Page