Slub Virus

 Virus Name:  Slub 
 V Status:    Rare 
 Discovered:  July, 1994 
 Symptoms:    .COM file growth; file date/time changes; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  1,024 Bytes 
 Type Code:   PRhCK - Resident Parasitic .COM Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, Sweep, 
                    NAV, NAVDX, VAlert, 
                    AVTK/N, Sweep/N, NProt, IBMAV/N, NShld, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Slub virus was received in July, 1994.  Its origin or point of 
       isolation is unknown.  Slub is a memory resident infector of .COM 
       programs, including COMMAND.COM. 
       When the first Slub infected program is executed, this virus will 
       become memory resident at the top of system memory but below the 640K 
       DOS boundary, not moving interrupt 12's return.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       have decreased by 1,024 bytes.  Interrupt 21 will be hooked by the 
       virus in memory.  Also at this time, the virus will infect two .COM 
       programs located in the current directory. 
       Once the Slub virus is memory resident, it will infect up to four .COM 
       programs in the current directory when any program is executed. 
       Infected programs will have a file length increase of 1,024 bytes with 
       the virus being located at the end of the file.  The program's date 
       and time in the DOS disk directory listing will have been updated to 
       the current system date and time when infection occurred.  The 
       following text strings are visible within the viral code in all Slub 
       infected programs: 
               "c:\autoexec.bat c:\slubdestr.n23" 

Show viruses from discovered during that infect .

Main Page