Virus Name: Tatou
V Status: Rare
Discovered: December, 1992
Symptoms: .COM file growth; TSR; file time seconds set to "62"
Eff Length: 1,153 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, ViruScan, Sweep, AVTK, PCScan,
IBMAV, NAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, NProt, AVTK/N, LProt, IBMAV/N,
Removal Instructions: Delete infected files
The Tatou virus was received from Poland in December, 1992. Tatou
is a memory resident infector of .COM programs, including
When the first Tatou infected program is executed, the Tatou virus
will install itself memory resident as a low system memory TSR of
1,424 bytes. It hooks interrup 21.
Once the Tatou virus is memory resident, it will infect .COM
programs when they are executed. Infected programs will have a
file length increase of 1,153 bytes with the virus being located
at the end of the file. The file's date and time in the DOS disk
directory listing will appear to not be altered, though the file
time's seconds field will have been set to "62". The following
text string is visible within all Tatou infected programs:
It is unknown what Tatou does besides replicate.