Virus Name: Signs
Aliases: Signs of Life
V Status: Rare
Discovered: December, 1992
Symptoms: .COM file growth; TSR
Eff Length: 720 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan, NAVDX,
NAV, VAlert, PCScan, ChAV,
Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected files
The Signs, or Signs of Life, virus was submitted in December, 1992.
Its origin or point of isolation is unknown. Signs is a memory
resident infector of .COM programs, including COMMAND.COM.
When the first Signs infected program is executed, the Signs virus
will install itself memory resident as a low system memory TSR of
720 bytes. It will hook interrupt 21. Some memory mapping
utilities may show the TSR as being an increase in the size of the
"config" area in memory.
Once the Signs virus is memory resident, it will infect .COM
programs when they are executed. Infected programs will have a
file length increase of 720 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text string
can be found within the viral code in all Signs infected programs:
"Signs Of Life."
It is unknown what Signs may do besides replicate.