Sparse Virus

Virus Name: Sparse Aliases: Sparse-B V Status: Rare Discovered: April, 1991 Symptoms: TSR; .COM growth; gradual decrease in available free memory Origin: Unknown Eff Length: 3,840 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, PCScan, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Sparse virus was received in April, 1991. Sparse is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with Sparse is executed, the virus will install itself memory resident as a low system memory TSR of 3,872 bytes. Interrupts 21, D1 and D3 will be hooked by the virus. Once Sparse is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected .COM programs will increase in size by 3,840 bytes with the virus being located at the beginning of the infected file. The infected file's date and time in the disk directory will also be updated to the system date and time when infection occurred. Programs infected with Sparse will have the ASCII characters "UK" as the second and third bytes of the executable program. They will also contain the text string SHELLC, and contain the name of the program that originally resulted in the virus becoming memory resident. (If the first infected program executed was "sparse.com", then "sparse.com" will be found in all later infected programs as long as the virus was memory resident.) Systems infected with Sparse will slowly have less and less available free memory available. The loss of free memory occurs once the virus is memory resident, execution of an infected program will result in an additional 64K block of memory being allocated. If the user executes 10 infected programs, in effect there will be no free memory available. Known variant(s) of Sparse are: Sparse-B: Functionally equivalent to the original Sparse virus, this variant has approximately 20 bytes which differ.