Silly-365 Virus
Virus Name: Silly-365
Aliases: Pixel, Pixel 877
V Status: Rare
Discovered: May, 1991
Symptoms: .COM file growth; slow to very slow program loads; file date/
time changes
Origin: Europe
Eff Length: 877+ Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, PCScan,
NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Silly-365 virus was received from Europe in May, 1991. It is a
very buggy variant of the Silly virus. Like Silly, it is a non-
resident direct action infector of .COM programs, including
COMMAND.COM. It is being listed separately as its behavior and
symptoms of infection are considerably different.
When a program infected with Silly-365 is executed, the virus will
search the current drive current directory, and infect all .COM
programs found. If the .COM programs in the current directory were
previously infected by Silly-365, they will be reinfected. Programs
infected with Silly-365 will have their date and time in the disk
directory updated to the current system date and time with each
infection and reinfection.
The bugs in Silly-365 have to do with the reinfections of programs.
With the first infection of a program by Silly-365, the infected
program will increase in size by 877 bytes. On the first
reinfection, the program will increase in size by an additional
877 bytes. The second reinfection will result in a file length
increase of 1,754 bytes. The third reinfection adds 3,508 bytes.
The pattern is that starting with the second reinfection, the
file increase is equal to two times the previous length increase.
Needless to say, even when starting with a very small 42 byte .COM
program, by the eighth infection, the program is too large to be
executed.
The other problem with Silly-365 is that it is very noticeable. As
the infection proceeds, the system takes longer and longer to
execute any .COM program. By the seventh reinfection on the one
of my test systems, the system was literally working on reinfecting
two .COM programs for 20 minutes.
The Silly-365 virus was intended to display the following message
when an 8th generation infection is executed:
"Sector not found error fucking defoult drive!
Please by me a new disk drive!"
This message, in actual 8th generation infections, is not displayed
as the 8th generation infected file is too large to be executed
as a .COM program.
Silly-365 received its name from its base code with is 365 bytes in
length. The Silly virus does not do anything besides replicate.
Known variant(s) of Silly-365 are:
Silly-740: Similar to Silly-365, this variant is actually 370
bytes in length. Like Silly-365, it reinfects files
multiple times, so infected files will increase in
size by some multiple of 370 or 740 bytes.
Origin: Unknown January, 1992.
See: Amstrad Hell Pixel Silly