Virus Name: Tamper
V Status: New
Discovered: July, 1994.
Symptoms: .EXE file growth; TSR
Eff Length: 1,400 - 1,414 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: AVTK, Sweep, ViruScan, NAV, PCScan,
AVTK/N, Sweep/N, NShld, NAV/N, LProt
Removal Instructions: Delete infected files
The Tamper virus was received in August, 1994. Its origin or point
of isolation is unknown. Tamper is a memory resident infector of
When the first Tamper infected program is executed, this virus will
install itself memory resident as a low system memory TSR of 1,744
bytes. Interrupt 21 will be hooked by the virus in memory.
Once the virus is memory resident, it will infect .EXE files when they
are executed. Infected programs will have a file length increase of
1,400 to 1,414 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory listing
will not be altered. The following text string is visible within
the viral code in all Tamper infected programs:
"WARNING: Do not tamper with this code !!! Systems &
Mgt. Dynamics, Inc."
It is unknown what Tamper does besides replicate.