Virus Name: Squawk
V Status: Rare
Discovered: March, 1992
Symptoms: .COM & .EXE growth; decrease in total system and available
Eff Length: 852 Bytes
Type Code: PRtAK - Parasitic Resident .COM & .EXE Infector
Detection Method: Sweep, AVTK, F-Prot, ViruScan, PCScan,
IBMAV, NAV, NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Squawk virus was submitted in March, 1992. Its origin is
unknown. Squawk is a memory resident infector of .COM and .EXE
programs, including COMMAND.COM.
When the first Squawk infected program is executed, the Squawk
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, moving interrupt 12's
return. Total system and available free memory, as measured
by the DOS CHKDSK program, will have decreased by 4,096 bytes.
Interrupt 21 will be hooked by the virus in memory.
Once Squawk is memory resident, it will infect .COM and .EXE
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 852 bytes with the
virus being located at the end of the infected file. The program's
date and time in the DOS disk directory listing will not be altered.
One text string can be found in all programs infected with the
"Nguyen Van Cuong - Siagon IBM comppany."
It is unknown what Squawk does besides replicate.