Slow Virus
Virus Name: Slow
Aliases: Slowdown, Zerotime
V Status: Common
Discovered: May, 1990
Symptoms: .COM & .EXE growth
Origin: Australia
Eff Length: 1,701 Bytes
Type Code: PRsA - Resident Parasitic .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc,
LProt
Removal Instructions: CleanUp, NAV, or delete infected files
General Comments:
The Slow virus was discovered in Australia in May 1990. It is a
memory resident generic file infector, infected .COM, .EXE, and
overlay files. COMMAND.COM is not infected by this virus.
The first time an infected file is executed on a system, the virus
installs itself memory resident as a low system memory TSR, taking
up 1,984 bytes of free memory. Interrupt 21 will be hooked by the
virus.
Later, as programs are executed, they will be infected by the Slow
virus. While the Slow virus's viral code is actually 1,701 bytes
in length, infected files will increase by more than this amount.
Infected .COM files will increase in length by 1,721 bytes with the
virus located at the beginning of the infected program. .EXE files
will increase in length by 1,716 to 1,728 bytes with the virus
located at the end of the infected program.
In the process of infecting some .EXE files, the virus may hang the
system, causing the user to have to reboot.
The Slow virus is based on the Jerusalem virus.
It is unknown what else the Slow virus does.
Known variant(s) of Slow are:
Slow II: A minor variant of the Slow virus described above,
this variant adds 1,721 bytes to the .COM programs it
infects, and 1,716 to 1,730 bytes to .EXE programs. The
virus is located at the beginning of .COM programs and
the end of .EXE programs. Infected programs will usually
not function properly, resulting in frequent system hangs.
Origin: Unknown January, 1993.
Slow III: Based on the Slow II variant, Slow III is very
similar, though the infected programs will no longer
hang the system.
Origin: Unknown March, 1993.
Slow IV: Based on the Slow III variant, Slow IV is very
similar.
Origin: Australia March, 1993.
See: Jerusalem