Tadpoles Virus

Virus Name: Tadpoles Aliases: Tadpoles.2792 V Status: New Discovered: February, 1995 Symptoms: .COM & .EXE growth; TSR Origin: Philippines Eff Length: 2,792 - 2,804 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, NAVDX, NAV, IBMAV, PCScan, AVTK 7.68+, NShld, NAV/N, IBMAV/N, AVTK/N 7.68+ Removal Instructions: Delete infected files General Comments: The Tadpoles virus was received in February, 1995. It is from Cebu City in the Philippines. Tadpoles is a memory resident infector of .COM and .EXE files, including COMMAND.COM. When the first Tadpoles infected program is executed, this virus will install itself memory resident as a low system memory TSR of 3,232 bytes. Interrupt 21 and 2F will be hooked by the virus in memory. Once the Tadpoles virus is memory resident, it will infect .COM and .EXE files when they are executed. Infected .COM files will have a file length increase of 2,792 bytes. .EXE files increase in size by 2,792 to 2,804 bytes. In both cases, the virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Tadpoles infected files: "CCCv (w) CCC CompE... Hail U.C.!" It is unknown what the Tadpoles virus does besides replicate.