Virus Name: Silence
V Status: Rare
Discovered: July, 1992
Symptoms: .COM file growth; decrease in total system & available free
Eff Length: 555 Bytes
Type Code: PRhCK - Non-Resident Parasitic .COM Infector
Detection Method: ViruScan, F-Prot, IBMAV, AVTK, NAVDX,
Sweep, NAV, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Silence virus was received in July, 1992. Silence is a memory
resident infector of .COM programs, including COMMAND.COM. Its
origin or point of isolation is unknown.
The first time a program infected with the Silence virus is executed,
the Silence virus will install itself memory resident at the top
of system memory but below the 640K DOS boundary. It does not move
interrupt 12's return. Total system and available free memory, as
indicated by the DOS CHKDSK program, will have decreased by 1,568
bytes. Interrupt 21 will be hooked by Silence in memory.
Once the Silence virus is memory resident, it will infect .COM
programs when they are executed. If COMMAND.COM is executed, it will
be infected by the virus. Programs infected with the Silence virus
will have a file length increase of 555 bytes with the virus being
located at the beginning of the file. The program's date and time
in the DOS disk directory listing will not be altered. The following
text is encrypted within the virus:
"The Silence Of The Lambs!"
Silence doesn't appear to do anything besides replicate.