Virus Name: Shield
V Status: Rare
Discovered: March, 1992
Symptoms: .COM file growth; hidden .COM files created; file date/time
change; TSR; system hangs
Eff Length: 5,152 Bytes (companion files), 127 Bytes .COM
Type Code: PSRsA - Parasitic Spawning Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, NAV, NAVDX, VAlert, PCScan,
IBMAV, F-Prot, ChAV,
NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Shield virus was received in March, 1992. Its origin is
unknown. This virus is a memory resident spawning or companion
virus which infects .EXE programs by creating corresponding .COM
files. It also adds 127 bytes to .COM programs other than
COMMAND.COM, though these files do not carry an active viral
The first time a program infected with Shield is executed, the
Shield virus will install itself memory resident as a low system
memory TSR of 5,456 bytes. Interrupt 21 will be hooked.
Once the Shield virus is memory resident, it will create a hidden
companion .COM file of 5,152 bytes for each .EXE program which
is executed or opened. It will also add 127 bytes of code to
each .COM program which is executed or opened. The 127 bytes of
additional code is added to the end of .COM programs, and the
file's date and time in the DOS disk directory listing will
have been updated.
The Shield virus is creates an active infection only in the
companion, hidden .COM programs.
System hangs may occur on infected systems.