Virus Name: Shutdown
V Status: New
Discovered: July, 1995
Symptoms: .COM file growth
Eff Length: 698 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, ViruScan, Sweep, NAV, NAVDX, IBMAV,
NShld, Sweep/N, IBMAV/N, NAV/N, AVTK/N, NProt, LProt,
Removal Instructions: Delete infected files
The Shutdown virus was received in July, 1995. Its origin or point
of isolation is unknown. Shutdown is a non-resident, direct action
infector of .COM files located on the C: drive.
When a program infected with the Shutdown virus is executed, this
virus will infect the first .COM file located in the C: drive \DOS
directory. If this file was previously infected by the virus, the
virus will reinfect it.
Programs infected with the Shutdown virus will have a file length
increase of 698 bytes for each infection of the virus present on
the file. The viral code will be located at the beginning of the
file. The program's date and time in the DOS disk directory listing
will not be altered. The following text strings are visible within
the viral code in all infected programs:
"Computers must be shutdown to dedicate my sister!"
"-- HKs VTech --"
"C:\*. C:\DOS\*.COM \*.COM"
It is unknown what the Shutdown virus may do besides replicate.