Silly Willy Virus

Virus Name: Silly Willy Aliases: V Status: Rare Discovered: July, 1992 Symptoms: .COM file growth; .EXE files altered; display; diskette formatted Origin: Unknown Eff Length: 2,268 - 2,313 Bytes Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, F-Prot, AVTK, NAV, NAVDX, PCScan, ChAV, NShld, Sweep/N, NAV/N, LProt, AVTK/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Silly Willy virus was submitted in July, 1992. Its origin or point of isolation is unknown. Silly Willy is a non-resident direct action infector of .COM files, including COMMAND.COM. It also trojanizes .EXE programs. When a program infected with the Silly Willy virus is executed, it will infect or trojanize up to two programs on the C: drive. The virus will first look for the programs in the C: drive root directory, and then move downward as necessarily in the directory structure. Infected .COM programs will have a file length increase of 2,268 to 2,313 bytes with the virus being located at the beginning of the file. Trojanized .EXE programs will not have any file length increase. The programs date and time in the DOS disk directory listing will not be altered. When the user executes an .EXE program which has been trojanized by the Silly Willy virus, the system display will be cleared, and an animated face will appear in the upper left hand corner of the screen, accompanied by the following text: "Hello, I'm Silly Willy! - Now I'm formating Your HARDDISK! That's fine! - Isn't it (har,har)..." The C: drive will be accessed, though the disk is not formatted by the virus. After a short period of time, the screen will be cleared and the following message displayed: "ERROR: No SYSTEM found! No files on drive C: Insert SYSTEM diskette in drive A: and push any key!" The virus will then attempt to format the A: drive.