Online VSUM - Silver Dollar Virus

Silver Dollar Virus

Virus Name: Silver Dollar Aliases: V Status: Viron Discovered: July, 1992 Symptoms: .COM & .EXE programs overwritten; long disk accesses; programs do not execute properly Origin: Unknown Eff Length: 2,071 Bytes Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, NProt, Sweep/N, AVTK/N, NAV/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Silver Dollar virus was received in July, 1992. Its origin is unknown, though a mention is made within the virus of Boulder, Colorado in the United States. Silver Dollar is a non-resident overwriting virus which infects both .COM and .EXE programs. When a program infected with the Silver Dollar virus is executed, this virus will search the current directory for up to four previously uninfected programs to infect. If the program(s) are found, the virus will infect them, overwriting the first 2,071 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings can be found within all Silver Dollar infected programs: "Copyright(C) 1992 by CU, Boulder Colorado." "Program too big to fit in memory" "Person/People/Things we >>hate<<:" "Person/People we admire:" "Person/People/Things we think are cool: Irving Berlin's Music." "*.EXE *.COM" Systems infected by the Silver Dollar message may notice that the message "Program too big to fit in memory" will be displayed when attempting to execute some infected programs. Long disk accesses will also occur when infected programs are executed. Known variant(s) of Silver Dollar are: Silver Dollar-2A: Received in April, 1993, Silver Dollar-2A is a 1,644 byte version of the Silver Dollar virus described above. It infects four .EXE or .COM programs located in the current directory each time an infected program is executed, overwriting the first 1,644 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "Allocating memory.... Please wait...." "Hard time accessing memory, please turn off all RAM" "resident programs and press >>Enter<< to continue...." "Program too big to fit in memory" "Copyright(C) 1992 by Fairview High School, Boulder Colorado, 80303. Macintrashes Suck!" "Victoria McMath. XX" "Linda" "Darnell." ".. *.EXE *.COM" The first four text strings above are displayed as a message when an infected program is executed and all of the .COM and .EXE programs in the current directory have already been infected by the virus. Origin: April 1993 United States. Silver Dollar-2B: Received in April, 1993, Silver Dollar-2B is a 1,874 byte version of the Silver Dollar virus described above. It infects four .EXE or .COM programs located in the current directory each time an infected program is executed, overwriting the first 1,874 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "Allocating memory.... Please wait...." "Hard time accessing memory, please turn off all RAM" "resident programs and press >>Enter<< to continue...." "Program too big to fit in memory" "Copyright(C) 1992 by Fairview High School, Boulder Colorado, 80303. Macintrashes Suck!" "Person/People/Things we >>hate<<: Paul Harvey's sucks!!!!! MacinTrashes Suck!!!! BASIC Suck!!!!" "Windows sort of suck. Person/People we admire:" "Victoria McMath(Ginger Rogers)," "Linda Darnell. Person/People/Things we think are cool:" "The author of Star Trek, Poker Faces, C++, LISP. XX" ".. *.EXE *.COM" The first four text strings above are displayed as a message when an infected program is executed and all of the .COM and .EXE programs in the current directory have already been infected by the virus. Origin: April 1993 United States. Silver Dollar-2D: Received in April, 1993, Silver Dollar-2D is a 2,218 byte version of the Silver Dollar virus described above. It infects four .EXE or .COM programs located in the current directory each time an infected program is executed, overwriting the first 2,218 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "Allocating memory.... Please wait...." "Hard time accessing memory, please turn off all RAM" "resident programs and press >>Enter<< to continue...." "Program too big to fit in memory" "Copyright(C) 1992 by Fairview High School, Boulder Colorado, 80303. Macintrashes Suck!" "Person/People/Things we >>hate<<: Paul Harvey's sucks!!!!! MacinTrashes Suck!!!! Graham (Not Alexander but this fuck ass kids whjo calls himself graham) sucks!" "Person/People we admire:Lynn Bari, Jean Arthur, Jane Russell" "Person/People/Things we think are cool: Cybernetics, C++, 39 Steps, The Mafia, maybe "Monty Python"" ".. *.EXE *.COM" The first four text strings above are displayed as a message when an infected program is executed and all of the .COM and .EXE programs in the current directory have already been infected by the virus. Origin: April 1993 United States. Silver Dollar-2F: Received in April, 1993, Silver Dollar-2F is a 736 version of the Silver Dollar virus described above. It infects four .EXE or .COM programs located in the current directory each time an infected program is executed, overwriting the first 736 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: ".. *.EXE *.COM" The message "Program too big to fit in memory" will some- times be displayed when an infected program is executed. Origin: April 1993 United States. Silver Dollar-8101: Received in August, 1992, from a United States source, Silver Dollar-8101 is a 8,101 byte version of the Silver Dollar virus described above. It infects one .COM or .EXE program located in the current directory each time an infected program is executed, overwriting the first 8,101 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "Copyright(C) 1992 by CU, Boulder Colorado." "Person/People/Things we >>hate<<:" "Person/People we admire:A Midgit, or maybe two :-)." "The Luna - moon. Ivy, Irene, Iris" "Person/People/Things we think are cool or find phus:" "Strip Poker," "Gambling." "PLO" "The Silver Dollar Virus Strikes Again" "This is dedicated to a nice person AMY" "Everyone say Hi Amy!" "*.EXE *.COM" Origin: August 1992 United States. Silver Dollar-SHJH: Received in April, 1993, Silver Dollar-SHJH is a 1,547 byte version of the Silver Dollar virus described above. It infects four .EXE or .COM programs located in the current directory each time an infected program is executed, overwriting the first 1,547 bytes of the host program. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "Allocating memory.... Please wait...." "Hard time accessing memory, please turn off all RAM" "resident programs and press >>Enter<< to continue...." "Program too big to fit in memory" "Copyright(C) 1992 by Souther Hills Jr. High, 1500 Knox Dr., Boulder Colorado, 80303. Macintrashes Suck!" "Victoria McMath. XX" "Linda" "Darnell." "*.EXE *.COM" The first four text strings above are displayed as a message when an infected program is executed and all of the .COM and .EXE programs in the current directory have already been infected by the virus. Occassionally, only the fourth text above is displayed as a message. Origin: April 1993 United States. See: Leprosy