Virus Name: Surrender
V Status: Rare
Discovered: January, 1992
Symptoms: .COM & .EXE growth; Interrupt 21 hooked
Eff Length: 513 Bytes
Type Code: PRaAK - Parasitic Resident .COM & .EXE Infector
Detection Method: Sweep, ViruScan, F-Prot, AVTK, PCScan,
NAV, IBMAV, NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The Surrender virus was submitted in January, 1992, and has an
unknown origin. Surrender is a memory resident infector of .COM
and .EXE programs. It will infect COMMAND.COM if it is executed.
The first time a program infected with the Surrender virus is
executed, this virus will install itself memory resident in the
DOS buffers and graphics card memory. There will be no change to
total system and available free memory as indicated by the DOS
CHKDSK program. Interrupt 21 will be hooked directly by the
virus in memory.
Once Surrender is memory resident, it will infect .COM and .EXE
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 513 bytes with the
virus being located at the end of the infected file. There will
be no change to the file's date and time in the DOS disk directory
The following text strings appear in the Surrender viral code in
all infected programs:
"Jews NEVER surrender!"
Surrender doesn't appear to do anything besides replicate.