Virus Name: StinkFoot
V Status: Rare
Discovered: November, 1991
Symptoms: .COM file growth; system crashes on 8086/8088 based machines
Origin: Republic of South Africa
Eff Length: 1,254 Bytes
Type Code: PNC - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, NAV, ChAV,
F-Prot, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The StinkFoot virus was discovered in the Republic of South Africa in
in November, 1991. It is a non-resident, direct action infector of
.COM files, and does not infect COMMAND.COM.
When a program infected with StinkFoot is executed, the virus will
search the current drive and directory for an uninfected .COM file
to infect whose uninfected length is at least 1,000 bytes. If such
a file is found, the virus will infect it. Programs infected with
StinkFoot will have a file length increase of 1,254 bytes. 259 bytes
of the virus will be located at the beginning of the infected file,
with the remaining 995 bytes of viral code being at the end of the
file. There will be no visible change in the file's date and time
in a DOS directory listing.
StinkFoot does not do anything besides replicate. It will not
function properly on XT (8088-based) machines.
Known variant(s) of StinkFoot are:
StinkFoot-1273: Sometimes referred to as Stink 2, StinkFoot-1273
is another version of this virus. It adds 1,273
bytes to the .COM programs it infects, splitting
the viral code between the beginning and the end of
Origin: Republic of South Africa June, 1992.
StinkFoot-2B: A minor variant of the StinkFoot virus described
above, this variant adds 1,254 bytes to the files it
infects with the first infection. It will reinfect
previously infected programs, adding an additional
1,273 bytes to the file.
Origin: Unknown March, 1993.