Virus Name: Stahl
V Status: Rare
Discovered: April, 1992
Symptoms: .COM file growth
Eff Length: 750 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The Stahl, or Stahlplatte, virus was submitted in April, 1992. It
is from Germany. Stahl is a non-resident, direct action infector
of .COM programs, including COMMAND.COM.
When a program infected with Stahl is executed, the virus will
infect one .COM file located in the current directory. If the
virus encounters a very small .COM file when it is searching
for a file to infect, it will stop infecting files.
Programs infected with the Stahl virus will have a file length
increase of 750 bytes. The virus will be located at the beginning
of the program. The file's date and time in the DOS disk
directory listing will not be altered. Two text strings can
be found in all Stahl infected programs:
"STAHLPLA.TTE Ich bin da!"
It is unknown what Stahl does besides replicate.