Skynet Virus

 Virus Name:  Skynet 
 V Status:    Rare 
 Discovered:  April, 1994 
 Symptoms:    .EXE file growth; Messages; system hangs; system output slowed; 
              decrease in total system & available free memory 
 Origin:      China 
 Eff Length:  1,448 - 1,462 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  F-Prot, ViruScan, AVTK, Sweep, ChAV, 
                    NAV, NAVDX, VAlert, IBMAV, PCScan, 
                    NShld, Sweep/N, AVTK/N, NProt, NAV/N, IBMAV/N, LProt, 
                    Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Skynet virus was received from China in April, 1994.  It is a 
       memory resident infector of .EXE files which disrupts system 
       When the first Skynet infected program is executed, the Skynet virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 1,664 bytes.  Interrupt 21 will be 
       hooked by the virus in memory. 
       Once the Skynet virus is memory resident, it will infect .EXE 
       programs when they are executed.  Infected .EXE programs will have 
       a file length increase of 1,448 to 1,462 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will not be altered.  The text from the 
       messages below can be found within the viral code in all infected 
       When a .COM program is executed with the Skynet virus memory 
       resident, the following message will be "typed" out to the 
       system display: 
               "Terminator Message: 
                Don't be afraid. 
                I am a very kind virus. 
                You have do many works today. 
                I will let your computer slow down. 
                        Have a nice day, 
                Press a key to continue. . ." 
       When a key is then pressed, it will display the following message 
       at the top of the screen, followed by the program output being 
       displayed in single lines: 
               "*** Terminator I *** Created by Sky Net in Chung-Li." 
       This message will also be displayed at the end of the output, as 
       well as at the end of all output from .EXE programs executed.  In 
       some cases, it will result in the loss of some of the output data 
       from the screen. 
       Besides the above messages, systems infected with Skynet will have 
       noticeably slow output, and unexpected system hangs may occur. 
       Known variant(s) of Skynet are: 
       Skynet.1809: Received from France in July, 1994, Skynet.1809 is a 
                    1,809 byte variant.  It infects either the program 
                    indicated by the environment COMSPEC variable, or a .EXE 
                    or .COM program, when an infected program is executed. 
                    Infected .COM programs increase in size by 1,809 bytes. 
                    Infected .EXE programs usually increase in size by 
                    1,809 to 1,849 bytes, though in the case of very small 
                    .EXE files, the file length increase may be as much as 
                    6,000 bytes.  In either case, the virus will be located 
                    at the end of the file.  The program's date and time in 
                    the DOS disk directory listing will have been updated to 
                    the current system date and time when infection occurred. 
                    The following text strings are visible within the viral 
                    code in all infected programs: 
                    "ENCULATOR III" 
                    Origin:  France  July, 1994. 

Show viruses from discovered during that infect .

Main Page