Tankar Virus


 Virus Name:  Tankar 
 Aliases:     Tankar.212 
 V Status:    New 
 Discovered:  January, 1996 
 Symptoms:    .COM file growth; file date/time changes; 
              decrease in available free memory 
 Origin:      Sweden 
 Eff Length:  212 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, ChAV, NAV, NAVDX, 
                    AVTK/N, IBMAV/N, NShld, NAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Tankar or Tankar.212 virus was received in January, 1996, along 
       with one variant.  It appears to be from Sweden.  Tankar is a memory 
       resident infector of .COM files, including COMMAND.COM. 
 
       When the first Tankar infected program is executed, this virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return. 
       Available free memory, as indicated by the DOS CHKDSK program from 
       DOS 5.0, will have decreased by 256 bytes.  Interrupt 21 will be 
       hooked by the virus. 
 
       Once the Tankar virus is memory resident, it will infect .COM files 
       when they are executed.  Infected .COM files will have a file 
       length increase of 212 bytes with the virus being located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will have been updated to the current system date 
       and time when infection occurred.  No significant text strings are 
       visible within the viral code. 
 
       Known variant(s) of Tankar are: 
       Tankar.476: Also received in January, 1996, this is a 476 byte 
           variant.  Its size in memory is 608 bytes, hooking interrupts 
           08 and 21.  Once resident, it infects .COM files when they are 
           executed.  Infected files will have a file length increase of 
           476 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are visible 
           within the viral code: 
           "Subconsious virus - Conzouler/IR 1995" 
           "Mina tankar r det sista som ni tar..." 
           "LOVE LOVE LOVE LOVE LOVE LOVE LOVE LOVE" 
           These text strings, along with characters from memory, may be 
           displayed on the system monitor when a program is executed. 
           Origin:  Sweden  January, 1996. 

Show viruses from discovered during that infect .

Main Page