Virus Name: Student-776
V Status: Rare
Discovered: November, 1993
Symptoms: .COM & .EXE growth; file date/time seconds = "62";
decrease in total system & available free memory
Eff Length: 776 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: IBMAV, F-Prot, ViruScan, Sweep, AVTK,
NAV, NAVDX, VAlert, PCScan, ChAV,
NProt, NShld, AVTK/N, Sweep/N, IBMAV/N, Innoc, NAV/N
Removal Instructions: Delete infected files
The Student-776 virus was received in November, 1993. Its origin or
point of isolation is unknown. Student-776 is a memory resident
infector of .COM and .EXE programs, including COMMAND.COM.
When the first Student-776 infected program is executed, this virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, not moving interrupt 12's return.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will have decreased by 1,024 bytes. Interrupt 80
will be hooked by the virus in memory. Also at this time, the
Student-776 virus will infect the first uninfected .COM program in
the current directory.
Once the Student-776 virus is memory resident, it will infect .COM
programs when they are executed or opened. Infected programs will
have a file length increase of 776 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not appear to be altered, but the
file date time seconds field will have been set to "62". The
following text string is encrypted within the Student-776 viral code:
"(C) Student 1993"
It is unknown what Student-776 does besides replicate.