Virus Name: Slime
V Status: Rare
Discovered: March, 1993
Symptoms: .COM file growth; decrease in total system & available free
memory; DOS CHKDSK file allocation errors
Eff Length: 773 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, Sweep, AVTK, ViruScan, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt
Removal Instructions: Delete infected files
The Slime, or ARCV-773, virus was submitted in March, 1993, and is
from England. Slime is a memory resident semi-stealth virus which
infects .COM programs, including COMMAND.COM.
When the first Slime infected program is executed, the Slime virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, hooking interrupt 21. Total system
and available free memory, as indicated by the DOS CHKDSK program,
will have decreased by 2,048 bytes. Interrupt 12's return will not
have been moved.
Once the Slime virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are executed or opened
for any reason. Infected programs will have a file length increase
of 773 bytes, though the file length increase will be hidden when
the virus is in memory. The Slime virus will be located at the end
of infected programs. The file's date and time in the DOS disk
directory listing will not be altered. The following text strings
are encrypted within the Slime viral code:
"[Slime] By Apache Warrior, ARCV Pres."
"Sliming around your PC,
I go make a sticky MESS over your Hard Drive!"
Additionally, the following text string can be located at the end of
all infected files:
When the Slime virus is memory resident, the DOS CHKDSK program
will detect file allocation errors on all infected files.