Virus Name: Tankard
Aliases: Tankard V2.0
V Status: New
Discovered: March, 1993.
Symptoms: .COM file growth; decrease in total system & available free
Eff Length: 493 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: AVTK, F-Prot, ViruScan, Sweep, IBMAV, PCScan,
NAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The Tankard, or Tankard V2.0, virus was submitted in March, 1993.
Its origin or point of isolation is unknown. Tankard is a memory
resident, fast infector of .COM programs, including COMMAND.COM.
When the first Tankard infected program is executed, the Tankard
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, hooking interrupt 21.
Interrupt 12's return will not be moved. Total system and
available free memory, as indicated by the DOS CHKDSK program,
will have decreased by 1,024 bytes.
Once the Tankard virus is memory resident, it will infect .COM
programs when they are executed or opened for any reason. Infected
programs will have a file length increase of 493 bytes with the
virus being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are visible within the Tankard viral code
in all infected programs:
It is unknown what Tankard may do besides replicate.
Known variant(s) of Tankard are:
Tankard V3.01: A 556 byte variant of the Tankard virus, this
variant's size in memory is also 1,024 bytes, hooking
interrupt 21. It adds 556 bytes to the .COM programs
it infects on execution and open. The following text
strings can be found within the Tankard V3.0 viral
code in infected programs:
"Tankard vers. 3.01"
Origin: Unknown March, 1993.