Tankar Virus
Virus Name: Tankar
Aliases: Tankar.212
V Status: New
Discovered: January, 1996
Symptoms: .COM file growth; file date/time changes;
decrease in available free memory
Origin: Sweden
Eff Length: 212 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, ChAV, NAV, NAVDX,
AVTK/N, IBMAV/N, NShld, NAV/N, Innoc
Removal Instructions: Delete infected files
General Comments:
The Tankar or Tankar.212 virus was received in January, 1996, along
with one variant. It appears to be from Sweden. Tankar is a memory
resident infector of .COM files, including COMMAND.COM.
When the first Tankar infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program from
DOS 5.0, will have decreased by 256 bytes. Interrupt 21 will be
hooked by the virus.
Once the Tankar virus is memory resident, it will infect .COM files
when they are executed. Infected .COM files will have a file
length increase of 212 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will have been updated to the current system date
and time when infection occurred. No significant text strings are
visible within the viral code.
Known variant(s) of Tankar are:
Tankar.476: Also received in January, 1996, this is a 476 byte
variant. Its size in memory is 608 bytes, hooking interrupts
08 and 21. Once resident, it infects .COM files when they are
executed. Infected files will have a file length increase of
476 bytes with the virus being located at the end of the file.
The program's date and time in the DOS disk directory listing
will have been updated to the current system date and time when
infection occurred. The following text strings are visible
within the viral code:
"Subconsious virus - Conzouler/IR 1995"
"Mina tankar „r det sista som ni tar..."
"LOVE LOVE LOVE LOVE LOVE LOVE LOVE LOVE"
These text strings, along with characters from memory, may be
displayed on the system monitor when a program is executed.
Origin: Sweden January, 1996.