Virus Name: Staf
V Status: Rare
Discovered: April, 1991
Symptoms: .COM growth; messages; programs may fail to execute
Eff Length: 2,083 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Staf virus was received in April, 1991. Its origin is unknown,
but first reports of it were out of Europe. This virus is a
non-resident direct action .COM file infector. It will infect
When a program infected with the Staf virus is executed, the virus
will display the following message:
"This program has been infected by:
Virus Demo Ver.: 1.1 - Handle with care!
By STAF (Tel.: (819) 595-0787)
Press any key to execute original program..."
The "n" following the pound sign above will be replaced with the
generation number of the virus. The "xxxxxxxx.COM" will contain
the name of the .COM program in the current directory which the
virus has just infected. If no uninfected .COM file existed in the
current directory when an infected program is executed, the
"Infecting:" portion of the message will be replaced with:
"I have infected all your files in the current directory!
Have a nice day!"
Programs infected with Staf may also fail to execute, with the
following message being displayed:
"VIRUS ERROR #nn - Aborting process."
Programs infected with Staf have a file size increase of 2,083
bytes with the virus being located at the beginning of the infected
file. The virus does not alter the file date and time in the disk
directory at the time a program is infected.
Staf does not do anything besides replicate.