Anto Virus

Virus Name: Anto Aliases: V Status: Rare Discovery: January, 1992 Symptoms: .COM file growth; file date/time changes; system hangs; boot failure; Divide overflow errors Origin: Unknown Eff Length: 129 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: Sweep, ViruScan, F-Prot, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Anto Virus was submitted in January, 1992. Its origin, or point of isolation, are unknown. Anto is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Anto virus is executed, the Anto virus will infect all .COM programs located in the current directory. If COMMAND.COM is located in this directory, it will be infected. This virus cannot recognize when programs have been previously infected by the virus, so they will be reinfected if previously infected. Programs infected with the Anto virus will have a file length increase of 129 bytes with each infection of the Anto virus present on the host file. The virus will be located at the beginning of the infected file, and in the case of reinfected files, will also be found at the end of the file. The program's date and time in the DOS disk directory listing will have been altered to the current system date and time when the last infection occurred. Systems infected with the Anto virus may notice frequent system hangs or "Divide overflow" errors when infected programs are executed. Attempts to boot from an infected copy of COMMAND.COM will also result in a system hang with the message "Cannot start COMMAND, exiting".