Smiley Virus
Virus Name: Smiley
Aliases:
V Status: Rare
Discovered: January, 1992
Symptoms: .COM file growth; interrupt 1C hooked; program hangs;
Smiley face ASCII character bouncing around screen
Origin: Unknown
Eff Length: 1,987 - 1,994 Bytes
Type Code: PRfCK - Parasitic Resident .COM Program Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, NAVDX, PCScan,
NAV, IBMAV, VAlert, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
LProt, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Smiley virus was submitted in January, 1992. Its origin or
point of original isolation is unknown. Smiley is a memory
resident virus, but its infection mechanism is that of a
non-resident direct action .COM infector. The memory resident
portion is only used for the virus' screen effect.
When a program infected with the Smiley virus is executed, the
Smiley virus may infect one .COM file in the current directory.
This virus does not infect files each time an infected program
is executed. For example, if it encounters a very small .COM
file in the current directory as it searchs for an uninfected
file, it will typically not infect anything on that execution.
Programs infected with the Smiley virus will have a file length
increase of 1,987 to 1,994 bytes. The virus will be located at
the end of the infected file. The program's date and time in
the DOS disk directory listing will not have been altered.
The following text strings can be found within the viral code in
Smiley infected programs:
"\*.EXE *.* \*.COM"
"yANKEE Doodle#and VACsin."
"The red planet("InvasiOn"
"????????COM"
Once COMMAND.COM in the user's boot drive root directory is infected,
the Smiley virus will install a portion of itself memory resident
in available free memory the next time the user boots the system.
At this time, the Smiley virus will have hooked interrupt 1C. After
a short period of time has elasped, the Smiley virus will produce
a screen effect of an ASCII smiley face character which bounces
around the system display.
It is unknown if Smiley carries any damage potential.