Shutdown Virus

 Virus Name:  Shutdown 
 Aliases:     Shutdown.698 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .COM file growth 
 Origin:      Unknown 
 Eff Length:  698 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method: F-Prot, AVTK, ViruScan, Sweep, NAV, NAVDX, IBMAV, 
                   PCScan, ChAV, 
                   NShld, Sweep/N, IBMAV/N, NAV/N, AVTK/N, NProt, LProt, 
                   Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Shutdown virus was received in July, 1995.  Its origin or point 
       of isolation is unknown.  Shutdown is a non-resident, direct action 
       infector of .COM files located on the C: drive. 
       When a program infected with the Shutdown virus is executed, this 
       virus will infect the first .COM file located in the C: drive \DOS 
       directory.  If this file was previously infected by the virus, the 
       virus will reinfect it. 
       Programs infected with the Shutdown virus will have a file length 
       increase of 698 bytes for each infection of the virus present on 
       the file.  The viral code will be located at the beginning of the 
       file.  The program's date and time in the DOS disk directory listing 
       will not be altered.  The following text strings are visible within 
       the viral code in all infected programs: 
           "Computers must be shutdown to dedicate my sister!" 
           "--  HKs VTech --" 
           "C:\*.    C:\DOS\*.COM          \*.COM" 
       It is unknown what the Shutdown virus may do besides replicate. 

Show viruses from discovered during that infect .

Main Page