Shizu Virus

Virus Name: Shizu Aliases: Carefull, Shizu.568, VD.568 V Status: New Discovered: February, 1995 Symptoms: .COM file growth; unexpected accesses to disk drives Origin: Unknown Eff Length: 568 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, Sweep, ViruScan, NAVDX, VAlert, NAV, PCScan, ChAV, Sweep/N, NProt, AVTK/N, NShld, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Shizu virus was received in February, 1995. Its origin or point of isolation is unknown. Shizu is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the Shizu virus is executed, this virus will infect the first uninfected .COM file located in the current directory. Programs infected with the Shizu virus will have a file length increase of 568 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found starting in the fifth byte of all infected files: "VD" The following text strings are encrypted within the viral code: "*.COM" "--- Be careful VIRUS !!! ---" Once the Shizu virus has infected all of the .COM files in the current drive current directory, it may access other drives to locate programs to infect.