Staf Virus

Virus Name: Staf Aliases: Staff V Status: Rare Discovered: April, 1991 Symptoms: .COM growth; messages; programs may fail to execute Origin: Unknown Eff Length: 2,083 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Staf virus was received in April, 1991. Its origin is unknown, but first reports of it were out of Europe. This virus is a non-resident direct action .COM file infector. It will infect COMMAND.COM. When a program infected with the Staf virus is executed, the virus will display the following message: "This program has been infected by: Virus Demo Ver.: 1.1 - Handle with care! By STAF (Tel.: (819) 595-0787) Generation #n Infecting: xxxxxxxx.COM Press any key to execute original program..." The "n" following the pound sign above will be replaced with the generation number of the virus. The "xxxxxxxx.COM" will contain the name of the .COM program in the current directory which the virus has just infected. If no uninfected .COM file existed in the current directory when an infected program is executed, the "Infecting:" portion of the message will be replaced with: "I have infected all your files in the current directory! Have a nice day!" Programs infected with Staf may also fail to execute, with the following message being displayed: "VIRUS ERROR #nn - Aborting process." Programs infected with Staf have a file size increase of 2,083 bytes with the virus being located at the beginning of the infected file. The virus does not alter the file date and time in the disk directory at the time a program is infected. Staf does not do anything besides replicate.