Virus Name: Anto
V Status: Rare
Discovery: January, 1992
Symptoms: .COM file growth; file date/time changes; system hangs;
boot failure; Divide overflow errors
Eff Length: 129 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: Sweep, ViruScan, F-Prot, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Anto Virus was submitted in January, 1992. Its origin, or point
of isolation, are unknown. Anto is a non-resident, direct action
infector of .COM programs, including COMMAND.COM.
When a program infected with the Anto virus is executed, the Anto
virus will infect all .COM programs located in the current directory.
If COMMAND.COM is located in this directory, it will be infected.
This virus cannot recognize when programs have been previously
infected by the virus, so they will be reinfected if previously
Programs infected with the Anto virus will have a file length
increase of 129 bytes with each infection of the Anto virus present
on the host file. The virus will be located at the beginning of
the infected file, and in the case of reinfected files, will also
be found at the end of the file. The program's date and time in the
DOS disk directory listing will have been altered to the current
system date and time when the last infection occurred.
Systems infected with the Anto virus may notice frequent system
hangs or "Divide overflow" errors when infected programs are
executed. Attempts to boot from an infected copy of COMMAND.COM
will also result in a system hang with the message "Cannot start