Slime Virus

Virus Name: Slime Aliases: ARCV-773 V Status: Rare Discovered: March, 1993 Symptoms: .COM file growth; decrease in total system & available free memory; DOS CHKDSK file allocation errors Origin: England Eff Length: 773 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: F-Prot, Sweep, AVTK, ViruScan, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Slime, or ARCV-773, virus was submitted in March, 1993, and is from England. Slime is a memory resident semi-stealth virus which infects .COM programs, including COMMAND.COM. When the first Slime infected program is executed, the Slime virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Interrupt 12's return will not have been moved. Once the Slime virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed or opened for any reason. Infected programs will have a file length increase of 773 bytes, though the file length increase will be hidden when the virus is in memory. The Slime virus will be located at the end of infected programs. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Slime viral code: "COM" "[Slime] By Apache Warrior, ARCV Pres." "Sliming around your PC, I go make a sticky MESS over your Hard Drive!" Additionally, the following text string can be located at the end of all infected files: "4Qu2u" When the Slime virus is memory resident, the DOS CHKDSK program will detect file allocation errors on all infected files.