Something Virus

Virus Name: Something Aliases: Something-658 V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; SOME. file created; decrease in total system and available free memory Origin: Unknown Eff Length: 658 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, PCScan, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Something virus was received from Europe in November, 1991. Its origin, and point of isolation, are unknown. Something is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with the Something virus is executed, the Something virus will become memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 672 bytes. Interrupt 12's return will not have been moved. Interrupt 21 will be hooked by the Something virus in memory. At this time, a file will be created in the current directory named SOME. (the file name extension will be blank). This file will have a length of zero bytes. Once the Something virus is memory resident, it will infect any .COM file which is executed, including COMMAND.COM. Infected .COM files will have a file length increase of 658 bytes with the virus being located at the beginning of the infected file. The following text string will be found within the viral code in infected programs: "Something v1.1" It is unknown if the Something virus does anything besides replicate.