Virus Name: Spring
V Status: Rare
Discovered: August, 1993
Symptoms: .COM & .EXE growth;
decrease in total system & available free memory
Eff Length: 640 - 655 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAVDX,
NAV, VAlert, PCScan,
AVTK/N, NShld, Sweep/N, NProt, IBMAV/N, NAV/N
Removal Instructions: Delete infected files
The Spring, or Spring-640, virus was received in August, 1993. Its
origin or point of isolation is unknown. Spring is a memory resident
infector of .COM and .EXE programs, including COMMAND.COM.
When the first Spring-640 infected program is executed, this virus
will become memory resident at the top of system memory but below the
640K DOS boundary, not moving interrupt 12's return. Total system
and available free memory, as indicated by the DOS CHKDSK program,
will have decreased by 768 bytes. Interrupt 21 will be hooked by
Spring in memory.
Once the Spring virus is memory resident, it will infect .COM and
.EXE programs, including COMMAND.COM, when they are executed.
Infected programs will have a file length increase of 640 to 655
bytes with the virus being located at the end of the file. The
file's date and time in the DOS disk directory listing will not be
altered. The following text string is visible within the viral code
in all Spring infected programs:
It is unknown what Spring does besides replicate.
Known variant(s) of Spring are:
Spring-768: Received in August, 1993, Spring-768 appears to be
a later version of the Spring virus described above. Its
size in memory, and memory usage, is the same as for the
original virus. Spring-768 infects .COM and .EXE
programs, including COMMAND.COM, when they are executed
or opened for any reason. Infected programs increase in
size by 768 - 783 bytes with the virus being located at
the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The
following text string is visible within the viral code
in all Spring-768 infected programs:
Origin: Unknown August, 1993.