Tatou Virus

Virus Name: Tatou Aliases: V Status: Rare Discovered: December, 1992 Symptoms: .COM file growth; TSR; file time seconds set to "62" Origin: Poland Eff Length: 1,153 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: F-Prot, ViruScan, Sweep, AVTK, PCScan, IBMAV, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, NProt, AVTK/N, LProt, IBMAV/N, NAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Tatou virus was received from Poland in December, 1992. Tatou is a memory resident infector of .COM programs, including COMMAND.COM. When the first Tatou infected program is executed, the Tatou virus will install itself memory resident as a low system memory TSR of 1,424 bytes. It hooks interrup 21. Once the Tatou virus is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 1,153 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will appear to not be altered, though the file time's seconds field will have been set to "62". The following text string is visible within all Tatou infected programs: "COM" It is unknown what Tatou does besides replicate.