StarDot 801 Virus

Virus Name: StarDot 801 Aliases: Italian File V Status: Rare Discovered: April, 1991 Symptoms: .COM & .EXE growth; system hangs; hard disk corruption Origin: Unknown Eff Length: 801 Bytes Type Code: PNAK - Parasitic Non-Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, LProt, Sweep/N, NShld, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The StarDot 801 virus was submitted in April, 1991. Its origin is unknown, though it is very similar to the Italian 803 virus, so it may also be from Italy. StarDot 801 is a non-resident, direct action infector of .COM and .EXE programs. It will infect COMMAND.COM. When a program infected with StarDot 801 is executed, the virus will look for an uninfected .EXE program in the current directory to infect. If an uninfected .EXE program does not exist in the current directory, it will then look for an uninfected .COM program to infect. Once an uninfected program is selected, the virus will infect it, adding the viral code to the end of the program. Programs infected with StarDot 801 will increase in size by 804 to 817 bytes. Their date and time in the disk directory will not be altered. StarDot 801 activates on February 13th when the system time is 1PM or later. At that time, it will write random data to all disk drives on the system in reverse order (it starts at drive Z:). System hangs may occur when some infected programs are executed. See: StarDot 600 StarDot 789