Aragorn Virus

 Virus Name:  Aragorn 
 V Status:    Rare 
 Discovery:   March, 1993 
 Symptoms:    .COM & .EXE growth; write protect errors; message 
 Origin:      Italy 
 Eff Length:  1,522 - 1,537 Bytes 
 Type Code:   PNAK - Parasitic Non-Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, Sweep, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, NProt, NAV/N, AVTK/N, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Aragorn virus was submitted in March, 1993, and is originally 
       from Italy.  Aragorn is a non-resident, direct action infector of 
       .COM and .EXE programs, including COMMAND.COM.  It displays an 
       Ansi graphics message on its activation on October 28th of any 
       When a program infected with the Aragorn virus is executed, this 
       virus will infect one .COM file and one .EXE program located in 
       the current directory.  Due to a bug in the virus, once Aragorn 
       infects the first .EXE file in the directory, it will not infect 
       other .EXE programs within the directory.  This same bug doesn't 
       occur with .COM programs. 
       Programs infected with the Aragorn virus will have a file length 
       increase of 1,522 to 1,537 bytes with the virus being located at 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       are visible within the viral code in all Aragorn infected files: 
               "(C)1992 Aragorn-Rome" 
               "*.com *.exe" 
       The last text string occurs at the very end of infected files. 
       The Aragorn virus activates when an infected program is executed 
       on October 28th of any year, at which time it will display the 
       following message in Ansi text.  The indicated {color bar} is 
       a representation of the Italian flag: 
                  28 OTTOBRE 
                MARCIA SU ROMA 
                {  color bar } 
                BOIA CHI MOLLA" 
       The text for this message is not visible within infected programs. 

Show viruses from discovered during that infect .

Main Page