Sorry Virus

 Virus Name:  Sorry 
 Aliases:     G-Virus V1.3, Perfume-2 
 V Status:    Rare 
 Discovered:  June, 1990 
 Symptoms:    .COM growth; decrease in system and free memory 
 Eff Length:  731 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, Sweep, IBMAV, PCScan, NAV, 
                    NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  NAV, or delete infected files 
 General Comments: 
       The Sorry virus was isolated in June, 1990.  Its name comes from a 
       German phrase in the virus: "Tut mir Leid !".  This virus is based 
       on the Perfume virus from West Germany, and some anti-viral 
       programs will identify it as Perfume or 4711. 
       The first time a program infected with the Sorry virus is executed, 
       the virus will install itself memory resident in high memory. 
       Total system memory and free memory will both decrease by 1,024 
       bytes. Interrupt 21 will be hooked by the virus.  COMMAND.COM is 
       immediately infected by the virus, thus insuring on later system 
       boots that the virus becomes memory resident immediately. 
       After the virus is memory resident, it will infect any .COM file 
       which is executed, increasing the file's length by 731 bytes.  The 
       viral code is located at the end of infected files. 
       The Sorry virus contains the following text strings: 
                "G-VIRUS V1.3" 
                "Bitte gebe den G-Virus Code ein" 
                "Tut mir Leid !" 
       It is unknown what the Sorry virus does when it activates. 
       See:   Perfume 

Show viruses from discovered during that infect .

Main Page