Virus Name: Sorry
Aliases: G-Virus V1.3, Perfume-2
V Status: Rare
Discovered: June, 1990
Symptoms: .COM growth; decrease in system and free memory
Eff Length: 731 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, IBMAV, PCScan, NAV,
NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: NAV, or delete infected files
The Sorry virus was isolated in June, 1990. Its name comes from a
German phrase in the virus: "Tut mir Leid !". This virus is based
on the Perfume virus from West Germany, and some anti-viral
programs will identify it as Perfume or 4711.
The first time a program infected with the Sorry virus is executed,
the virus will install itself memory resident in high memory.
Total system memory and free memory will both decrease by 1,024
bytes. Interrupt 21 will be hooked by the virus. COMMAND.COM is
immediately infected by the virus, thus insuring on later system
boots that the virus becomes memory resident immediately.
After the virus is memory resident, it will infect any .COM file
which is executed, increasing the file's length by 731 bytes. The
viral code is located at the end of infected files.
The Sorry virus contains the following text strings:
"Bitte gebe den G-Virus Code ein"
"Tut mir Leid !"
It is unknown what the Sorry virus does when it activates.