Sorry Virus

Virus Name: Sorry Aliases: G-Virus V1.3, Perfume-2 V Status: Rare Discovered: June, 1990 Symptoms: .COM growth; decrease in system and free memory Origin: Eff Length: 731 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, IBMAV, PCScan, NAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: NAV, or delete infected files General Comments: The Sorry virus was isolated in June, 1990. Its name comes from a German phrase in the virus: "Tut mir Leid !". This virus is based on the Perfume virus from West Germany, and some anti-viral programs will identify it as Perfume or 4711. The first time a program infected with the Sorry virus is executed, the virus will install itself memory resident in high memory. Total system memory and free memory will both decrease by 1,024 bytes. Interrupt 21 will be hooked by the virus. COMMAND.COM is immediately infected by the virus, thus insuring on later system boots that the virus becomes memory resident immediately. After the virus is memory resident, it will infect any .COM file which is executed, increasing the file's length by 731 bytes. The viral code is located at the end of infected files. The Sorry virus contains the following text strings: "G-VIRUS V1.3" "Bitte gebe den G-Virus Code ein" "Tut mir Leid !" It is unknown what the Sorry virus does when it activates. See: Perfume