Skynet Virus
Virus Name: Skynet
Aliases:
V Status: Rare
Discovered: April, 1994
Symptoms: .EXE file growth; Messages; system hangs; system output slowed;
decrease in total system & available free memory
Origin: China
Eff Length: 1,448 - 1,462 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: F-Prot, ViruScan, AVTK, Sweep, ChAV,
NAV, NAVDX, VAlert, IBMAV, PCScan,
NShld, Sweep/N, AVTK/N, NProt, NAV/N, IBMAV/N, LProt,
Innoc 4.0+
Removal Instructions: Delete infected files
General Comments:
The Skynet virus was received from China in April, 1994. It is a
memory resident infector of .EXE files which disrupts system
operation.
When the first Skynet infected program is executed, the Skynet virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 1,664 bytes. Interrupt 21 will be
hooked by the virus in memory.
Once the Skynet virus is memory resident, it will infect .EXE
programs when they are executed. Infected .EXE programs will have
a file length increase of 1,448 to 1,462 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The text from the
messages below can be found within the viral code in all infected
programs.
When a .COM program is executed with the Skynet virus memory
resident, the following message will be "typed" out to the
system display:
"Terminator Message:
Don't be afraid.
I am a very kind virus.
You have do many works today.
I will let your computer slow down.
Have a nice day,
Goodbye.
Press a key to continue. . ."
When a key is then pressed, it will display the following message
at the top of the screen, followed by the program output being
displayed in single lines:
"*** Terminator I *** Created by Sky Net in Chung-Li."
This message will also be displayed at the end of the output, as
well as at the end of all output from .EXE programs executed. In
some cases, it will result in the loss of some of the output data
from the screen.
Besides the above messages, systems infected with Skynet will have
noticeably slow output, and unexpected system hangs may occur.
Known variant(s) of Skynet are:
Skynet.1809: Received from France in July, 1994, Skynet.1809 is a
1,809 byte variant. It infects either the program
indicated by the environment COMSPEC variable, or a .EXE
or .COM program, when an infected program is executed.
Infected .COM programs increase in size by 1,809 bytes.
Infected .EXE programs usually increase in size by
1,809 to 1,849 bytes, though in the case of very small
.EXE files, the file length increase may be as much as
6,000 bytes. In either case, the virus will be located
at the end of the file. The program's date and time in
the DOS disk directory listing will have been updated to
the current system date and time when infection occurred.
The following text strings are visible within the viral
code in all infected programs:
"ENCULATOR III"
"COMSPEC="
"*.COM"
"*.EXE"
"SMARTCHK.*"
"CHKLIST.*"
"IRUS\ENCULATO"
"DESTI13"
"????????"
Origin: France July, 1994.