Tai-Pan Virus
Virus Name: Tai-Pan
Aliases: Tai-Pan.438, Whisper
V Status: Common
Discovered: July, 1994
Symptoms: .EXE file growth;
decrease in total system & available free memory
Origin: Unknown
Eff Length: 438 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: AVTK, ViruScan, Sweep, IBMAV, F-Prot, PCScan,
NAV, NAVDX, VAlert, ChAV,
AVTN/N, NShld, Sweep/N, IBMAV/N, NProt, NAV/N, Innoc,
LProt
Removal Instructions: Delete infected files
General Comments:
The Tai-Pan or Whisper virus was received in July, 1994. Its
origin or point of isolation is unknown, though it is in the
public domain in North America with many reported infections.
Tai-Pan is a memory resident infector of .EXE programs which
are smaller than approximately 64K.
When the first Tai-Pan infected program is executed, the Tai-Pan
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, not moving interrupt
12's return. Total system and available free memory, as
indicated by the DOS CHKDSK program, will have decreased by 512
bytes. Interrupt 21 will be hooked by the virus in memory.
Once memory resident, this virus will infect .EXE programs when
they are executed. Infected programs will have a file length
increase of 438 bytes with the virus being located at the end of
the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text string is
visible within the viral code in all infected programs:
"[Whisper presenterar Tai-Pan]"
The Tai-Pan virus doesn't do anything besides replicate, though
it may cause operational difficulties with some programs.
Known variant(s) of Tai-Pan are:
Tai-Pan.434: Received in July, 1995, this is a 434 byte variant
of the Tai-Pan virus described above. It infects .EXE files
when they are executed, adding 434 bytes to the host program's
length. The virus will be located at the end of the file, and
the program's date and time in the DOS disk directory listing
will not be altered. The following text string is visible within
the viral code:
"CoSmOPSQR"
This variant may cause text to scroll diagonally on the system
display, or scattered, making the system display unreadable.
Origin: Unknown July, 1995.
Tai-Pan.438.C: Received in January, 1996, this is a minor
variant of the Tai-Pan virus described above. Its size in
memory is 512 bytes, hooking interrupt 21, though this variant
will also reinfect memory, so the actually decrease in available
free memory may be considerably larger than 512 bytes. This
variant infects .EXE files when they are executed, adding 438
bytes to the program's length. The file's date and time in the
DOS disk directory listing will not be altered. It contains
the same text string as the original virus.
Origin: Unknown January, 1996.
Tai-Pan.641: Received in January, 1996, this is a 641 byte
variant of the Tai-Pan virus described above. Its size in
memory is 720 bytes, hooking interrupt 21. It infects .COM and
.EXE files, including COMMAND.COM, when they are executed.
Infected files will have a file length increase of 641 bytes with
the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be
altered. No text strings are visible within the viral code.
Origin: Unknown January, 1996.