Spring Virus


 Virus Name:  Spring 
 Aliases:     Spring-640 
 V Status:    Rare 
 Discovered:  August, 1993 
 Symptoms:    .COM & .EXE growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  640 - 655 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAVDX, 
                    NAV, VAlert, PCScan, 
                    AVTK/N, NShld, Sweep/N, NProt, IBMAV/N, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Spring, or Spring-640, virus was received in August, 1993.  Its 
       origin or point of isolation is unknown.  Spring is a memory resident 
       infector of .COM and .EXE programs, including COMMAND.COM. 
 
       When the first Spring-640 infected program is executed, this virus 
       will become memory resident at the top of system memory but below the 
       640K DOS boundary, not moving interrupt 12's return.  Total system 
       and available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 768 bytes.  Interrupt 21 will be hooked by 
       Spring in memory. 
 
       Once the Spring virus is memory resident, it will infect .COM and 
       .EXE programs, including COMMAND.COM, when they are executed. 
       Infected programs will have a file length increase of 640 to 655 
       bytes with the virus being located at the end of the file.  The 
       file's date and time in the DOS disk directory listing will not be 
       altered.  The following text string is visible within the viral code 
       in all Spring infected programs: 
 
               "699F" 
 
       It is unknown what Spring does besides replicate. 
 
       Known variant(s) of Spring are: 
       Spring-768: Received in August, 1993, Spring-768 appears to be 
                   a later version of the Spring virus described above.  Its 
                   size in memory, and memory usage, is the same as for the 
                   original virus.  Spring-768 infects .COM and .EXE 
                   programs, including COMMAND.COM, when they are executed 
                   or opened for any reason.  Infected programs increase in 
                   size by 768 - 783 bytes with the virus being located at 
                   the end of the file.  The program's date and time in the 
                   DOS disk directory listing will not be altered.  The 
                   following text string is visible within the viral code 
                   in all Spring-768 infected programs: 
                   "Spring" 
                   Origin:  Unknown  August, 1993.

Show viruses from discovered during that infect .

Main Page