Swedish Boys Virus


 Virus Name:  Swedish Boys 
 Aliases:     Data Molester, Headache, Swedish, Why Windows 
 V Status:    Rare 
 Discovered:  June, 1992 
 Symptoms:    .COM file growth; file date/time changes; files deleted; 
              disk corruption 
 Origin:      Sweden 
 Eff Length:  457, 459, or 538 Bytes (depending on variant present) 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, ViruScan, AVTK, Sweep, IBMAV, PCScan, 
                    NAV, NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, 
                    IBMAV/N, Innoc 
 Removal Instructions:  Delete infected programs 
 
 General Comments: 
       Swedish Boys is a group of initially three viruses received from 
       Sweden in June, 1992.  These viruses are all non-resident, direct 
       action infectors of .COM files, including COMMAND.COM.  Depending 
       on the variant present, they may be destructive. 
 
       The Swedish Boys viruses are: 
       Data Molester: The Data Molester virus is a non-resident, direct 
               action infector of .COM programs, including COMMAND.COM. 
               It will infect all .COM files located in the current 
               directory when an infected program is executed.  Infected 
               programs will have a file length increase of 538 bytes with 
               the virus being located at the end of the file.  The file's 
               date and time in the DOS disk directory listing will not 
               be altered.  The following text strings are encrypted 
               within the virus, and are not visible in infected files: 
               ":+:+ The Data Molester Virus V1.00 +:+:" 
               "The Vile One / The BetaBoys Development Corporation." 
               "*.COM" 
               Data Molester contains code to overwrite the C: drive 
               root directory and file allocation table. 
               Origin:  Sweden  June, 1992. 
       Headache: The Headache virus is a non-resident, direct action 
               infector of .COM programs, including COMMAND.COM.  It will 
               infect one .COM program in the current directory each time 
               an infected program is executed.  Infected programs will 
               have a file length increase of 459 bytes with the virus 
               being located at the end of the file.  The program's date 
               and time will be updated to the current system date and 
               time when infection occurred.  The following text strings 
               can be found within the viral code in all infected files: 
               "*.COM" 
               "-+( Severe Head-Ache Virus V2.oo )+-" 
               "Created by The Vile One & MaZ" 
               "Copyright (c)1992 The BetaBoys Development Corp" 
               "-Sweden 04/19/92" 
               Origin:  Sweden  June, 1992. 
       Swedish Boys.Headache.441: The Swedish Boys.Headache.441 virus is 
               a non-resident, direct action infector of .COM programs, 
               including COMMAND.COM.  It will infect one .COM program in the 
               current directory each time an infected program is executed. 
               Infected programs will have a file length increase of 441 
               bytes with the virus being located at the end of the file. 
               The program's date and time will be updated to the current 
               system date and time when infection occurred.  The following 
               text strings can be found within the viral code in all 
               infected files: 
               "*.COM" 
               "Severe Head-Ache Virus V2.oo )+-" 
               "Created by The Vile One & MaZ" 
               "Copyright (c)1992 The BetaBoys Development Corp" 
               "-Sweden 04/19/92" 
               Origin:  Sweden  July, 1994. 
       Why Windows: The Why Windows virus is a non-resident, direct 
               action infector of .COM programs, including COMMAND.COM. 
               It will infect one .COM program located in the current 
               directory each time an infected program is executed. 
               Infected programs will have a file length increase of 
               459 bytes with the virus being located at the end of the 
               program.  The file's date and time in the DOS disk directory 
               listing will have been updated to the current system date 
               and time when infection occurred.  The following text 
               strings can be found in the viral code in all Why Windows 
               infected programs: 
               "*.com" 
               "C:\Command.Com C:\Autoexec.Bat C:\Config.Sys" 
               "\windows\win.com" 
               "Why Windows (c)1992 MaZ / BetaBoys B.B" 
               Why Windows is a destructive virus.  It will attempt to 
               delete the file \windows\win.com.  Additionally, on 
               February 23rd of any year it will attempt to delete 
               C:\Autoexec.Bat.  On February 24th of any year, it will 
               attempt to delete C:\Config.Sys.  Lastly, on February 25th 
               of any year it will attempt to overwrite the C: drive root 
               directory and file allocation tables. 
               Origin:  Sweden  June, 1992.

Show viruses from discovered during that infect .

Main Page