Virus Name: Spyer
Aliases: Faust, Spyer-B, Spyer-C
V Status: Rare
Discovered: November, 1990
Symptoms: TSR; .COM & .EXE growth; system hangs
Eff Length: 1,181 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Spyer virus was isolated in November, 1990 in Taiwan. This
virus is a memory resident infector of .COM and .EXE files. It
does not infect COMMAND.COM.
The first time a program infected with the Spyer virus is executed,
the Spyer virus will install itself memory resident as a 1,760 byte
low system memory TSR. Interrupts 21 and 22 will be hooked by the
Once the virus is memory resident, the virus will attempt to infect
the next program that is executed. If the program is already
infected with the Spyer virus, the system will become hung. If the
program was not already infected, Spyer will infect it and then
hang the system.
Infected .COM files will always increase in length by 1,181 bytes.
EXE files infected with Spyer will have a file length increase
between 1,181 and 1,195 bytes. In both cases, the virus will be
located at the end of the infected file. Infected files will also
always have the following hex character sequence at the end of
The Spyer virus, in its present form, is not expected to ever be a
serious problem. Since it always hangs the system when the next
program is executed after becoming memory resident, it is simply
too obvious that something is wrong.
Known variant(s) of Spyer are:
Spyer-B: Similar to the original Spyer, this variant was
isolated from the NCSA virus collection received in
September, 1991. Its origin or original source is
unknown. Spyer-B is similar to Spyer, with the exception
that it only hooks interrupt 21. Infected .COM programs
will hang the system when executed, but infected .EXE
programs usually will not. Infected programs will have
the same hex character sequence at the end of the
infected file. Some anti-viral programs which detect
Spyer will miss this variant on some infected .COM files.
Spyer-C: Very similar to the original Spyer, this variant has
no user noteable differences. It was also isolated from
the NCSA virus collection received in September, 1991,
and its origin or source is unknown.