Surrender Virus


 Virus Name:  Surrender 
 Aliases:    
 V Status:    Rare 
 Discovered:  January, 1992 
 Symptoms:    .COM & .EXE growth; Interrupt 21 hooked 
 Origin:      Unknown 
 Eff Length:  513 Bytes 
 Type Code:   PRaAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  Sweep, ViruScan, F-Prot, AVTK, PCScan, 
                    NAV, IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, 
                    IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Surrender virus was submitted in January, 1992, and has an 
       unknown origin.  Surrender is a memory resident infector of .COM 
       and .EXE programs.  It will infect COMMAND.COM if it is executed. 
 
       The first time a program infected with the Surrender virus is 
       executed, this virus will install itself memory resident in the 
       DOS buffers and graphics card memory.  There will be no change to 
       total system and available free memory as indicated by the DOS 
       CHKDSK program.  Interrupt 21 will be hooked directly by the 
       virus in memory. 
 
       Once Surrender is memory resident, it will infect .COM and .EXE 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 513 bytes with the 
       virus being located at the end of the infected file.  There will 
       be no change to the file's date and time in the DOS disk directory 
       listing. 
 
       The following text strings appear in the Surrender viral code in 
       all infected programs: 
 
               "Jet" 
               "Jews NEVER surrender!" 
 
       Surrender doesn't appear to do anything besides replicate. 

Show viruses from discovered during that infect .

Main Page