Sparse Virus

 Virus Name:  Sparse 
 Aliases:     Sparse-B 
 V Status:    Rare 
 Discovered:  April, 1991 
 Symptoms:    TSR; .COM growth; gradual decrease in available free memory 
 Origin:      Unknown 
 Eff Length:  3,840 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, PCScan, 
                    NAV, IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Sparse virus was received in April, 1991.  Sparse is a memory 
       resident infector of .COM files, including COMMAND.COM. 
       The first time a program infected with Sparse is executed, the 
       virus will install itself memory resident as a low system memory 
       TSR of 3,872 bytes.  Interrupts 21, D1 and D3 will be hooked by 
       the virus. 
       Once Sparse is memory resident, it will infect .COM programs, 
       including COMMAND.COM, when they are executed.  Infected .COM 
       programs will increase in size by 3,840 bytes with the virus being 
       located at the beginning of the infected file.  The infected file's 
       date and time in the disk directory will also be updated to the 
       system date and time when infection occurred. 
       Programs infected with Sparse will have the ASCII characters "UK" 
       as the second and third bytes of the executable program.  They will 
       also contain the text string SHELLC, and contain the name of the 
       program that originally resulted in the virus becoming memory 
       resident.  (If the first infected program executed was 
       "", then "" will be found in all later infected 
       programs as long as the virus was memory resident.) 
       Systems infected with Sparse will slowly have less and less available 
       free memory available.  The loss of free memory occurs once the 
       virus is memory resident, execution of an infected program will 
       result in an additional 64K block of memory being allocated.  If the 
       user executes 10 infected programs, in effect there will be no free 
       memory available. 
       Known variant(s) of Sparse are: 
       Sparse-B: Functionally equivalent to the original Sparse virus, 
                 this variant has approximately 20 bytes which differ. 

Show viruses from discovered during that infect .

Main Page