Virus Name: Shirley
V Status: Rare
Discovered: 1991 (?)
Symptoms: .EXE file growth; TSR
Eff Length: 4,099 - 4,112 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: AVTK, F-Prot, IBMAV, Sweep, NAVDX,
Viruscan, NAV, VAlert, PCScan, ChAV,
NShld, Sweep/N, NProt, AVTK/N, LProt, IBMAV/N,
Removal Instructions: Delete infected files
The Shirley virus was submitted in December, 1992. It was originally
isolated in Germany in 1991. Shirley is a memory resident infector
of .EXE programs.
When the first Shirley infected program is executed, the Shirley
virus will install itself memory resident as a low system memory
TSR of 4,160 bytes. Interrupt 21 will be hooked by Shirley in
Once the Shirley virus is memory resident, it will infect .EXE
programs when they are executed. Infected programs will have a
file length increase of 4,099 to 4,112 bytes with the virus being
located at the end of the file. The program's date and time in
the DOS disk directory listing will not be altered. The following
text strings are visible within the viral code in all Shirley
"Marty McFly lives somewhere in time (Doc Brown)"
"Fuck for Eddie!!"
"There is only one place to spend nice holidays...
"Fuck for John McAfee and all the other Vrs-Killers..."
"We have a right to live !!!!!!!!"
"Greetings to the 1704... you were the first virus,
that infected my System!"
"Greetings to Jerusalem-B...You were the Second!"
"But now its my turn."
"Hope You have fun with the Shirley-Virus !!!!!!"
The text strings, other than the "IWANTSHIRLEY" string, also are
included within the viral code in German.