Tankard Virus


 Virus Name:  Tankard 
 Aliases:     Tankard V2.0 
 V Status:    New 
 Discovered:  March, 1993. 
 Symptoms:    .COM file growth; decrease in total system & available free 
              memory 
 Origin:      Unknown 
 Eff Length:  493 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  AVTK, F-Prot, ViruScan, Sweep, IBMAV, PCScan, 
                    NAV, NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Tankard, or Tankard V2.0, virus was submitted in March, 1993. 
       Its origin or point of isolation is unknown.  Tankard is a memory 
       resident, fast infector of .COM programs, including COMMAND.COM. 
 
       When the first Tankard infected program is executed, the Tankard 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary, hooking interrupt 21. 
       Interrupt 12's return will not be moved.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, 
       will have decreased by 1,024 bytes. 
 
       Once the Tankard virus is memory resident, it will infect .COM 
       programs when they are executed or opened for any reason.  Infected 
       programs will have a file length increase of 493 bytes with the 
       virus being located at the end of the file.  The program's date and 
       time in the DOS disk directory listing will not be altered.  The 
       following text strings are visible within the Tankard viral code 
       in all infected programs: 
 
               "IBMBIO.COM IBMDOS.COM" 
               "Tankard vers.2.0" 
  
       It is unknown what Tankard may do besides replicate. 
 
       Known variant(s) of Tankard are: 
       Tankard V3.01: A 556 byte variant of the Tankard virus, this 
                      variant's size in memory is also 1,024 bytes, hooking 
                      interrupt 21.  It adds 556 bytes to the .COM programs 
                      it infects on execution and open.  The following text 
                      strings can be found within the Tankard V3.0 viral 
                      code in infected programs: 
                      "IBMBIO.COM IBMDOS.COM" 
                      "Tankard vers. 3.01" 
                      Origin:  Unknown  March, 1993. 

Show viruses from discovered during that infect .

Main Page