Shutdown Virus

Virus Name: Shutdown Aliases: Shutdown.698 V Status: New Discovered: July, 1995 Symptoms: .COM file growth Origin: Unknown Eff Length: 698 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, ViruScan, Sweep, NAV, NAVDX, IBMAV, PCScan, ChAV, NShld, Sweep/N, IBMAV/N, NAV/N, AVTK/N, NProt, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Shutdown virus was received in July, 1995. Its origin or point of isolation is unknown. Shutdown is a non-resident, direct action infector of .COM files located on the C: drive. When a program infected with the Shutdown virus is executed, this virus will infect the first .COM file located in the C: drive \DOS directory. If this file was previously infected by the virus, the virus will reinfect it. Programs infected with the Shutdown virus will have a file length increase of 698 bytes for each infection of the virus present on the file. The viral code will be located at the beginning of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "Computers must be shutdown to dedicate my sister!" "-- HKs VTech --" "C:\*. C:\DOS\*.COM \*.COM" It is unknown what the Shutdown virus may do besides replicate.