Virus Name: Tchantches
V Status: New
Discovered: April, 1993
Symptoms: .COM & .EXE growth; graphic display & system hang;
decrease in total system & available free memory
Origin: Liege, Belgium
Eff Length: 3,303 - 3,318 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: AVTK, F-Prot, ViruScan, Sweep, IBMAV, NAV,
NAVDX, VAlert, ChAV,
NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Tchantches virus was submitted in April, 1993. It is originally
from Liege, Belgium, and is based on the Gotcha family of viruses.
Tchantches is a memory resident infector of .COM and .EXE programs,
When the first Tchantches infected program is executed, this virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, not moving interrupt 12's return.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will have decreased by 3,648 bytes. Interrupt 21
will be hooked by Tchantches in memory. Also at this time, the
Tchantches virus will infect COMMAND.COM.
Once the Tchantches virus is memory resident, it will infect .COM
and .EXE programs when they are executed or opened for any reason.
Tchantches infected programs will have a file length increase of
3,303 to 3,318 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory listing
will not be altered. The following text strings are encrypted within
the Tchantches viral code, thus not visible within infected files:
"TCHANTCHES démineur v1,10"
"Portez secours ů votre disque dur"
"(C)Copyright Setaicossa EefaCm '92"
The Tchantches virus activates when the virus becomes memory
resident on April 1st of any year. At this time, the virus will
draw a box centered on the system display. The first two lines
of text above will be at the top of the box, and the last two lines
of text at the bottom. The system will then be hung.