Shirley Virus

Virus Name: Shirley Aliases: V Status: Rare Discovered: 1991 (?) Symptoms: .EXE file growth; TSR Origin: Germany Eff Length: 4,099 - 4,112 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: AVTK, F-Prot, IBMAV, Sweep, NAVDX, Viruscan, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, LProt, IBMAV/N, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Shirley virus was submitted in December, 1992. It was originally isolated in Germany in 1991. Shirley is a memory resident infector of .EXE programs. When the first Shirley infected program is executed, the Shirley virus will install itself memory resident as a low system memory TSR of 4,160 bytes. Interrupt 21 will be hooked by Shirley in memory. Once the Shirley virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 4,099 to 4,112 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all Shirley infected programs: "IWANTSHIRLEY" "Marty McFly lives somewhere in time (Doc Brown)" "Fuck for Eddie!!" "There is only one place to spend nice holidays... "CASAL BORSETTI" "in Italy... "Fuck for John McAfee and all the other Vrs-Killers..." "We have a right to live !!!!!!!!" "Greetings to the 1704... you were the first virus, that infected my System!" "Greetings to Jerusalem-B...You were the Second!" "But now its my turn." "Hope You have fun with the Shirley-Virus !!!!!!" The text strings, other than the "IWANTSHIRLEY" string, also are included within the viral code in German.