Virus Name: TechnoRat
V Status: New
Discovered: March, 1993
Symptoms: .COM file growth; file date/time seconds set to "62"
Eff Length: 615 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: Sweep, AVTK, F-Prot, IBMAV, ViruScan,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, AVTK/N, NAV/N, IBMAV/N, Innoc, LProt
Removal Instructions: Delete infected files
The TechnoRat, or Rat-615, virus was submitted in March, 1993. It
appears to be from the USSR. TechnoRat is a non-resident, direct
action infector of .COM programs, including COMMAND.COM.
When a program infected with the TechnoRat virus is executed, this
virus will infect all of the .COM programs located in the current
directory, and the directory directly above the current directory.
Infected programs will have a file length increase of 615 bytes with
the virus being located at the end of the file. The program's date
and time in the DOS disk directory listing will not appear to be
altered, however the seconds field will have been set to "62". The
following text strings are visible within the TechnoRat viral code
in all infected files:
"Techno-Rat I. Copyright by Lord Blaise, Odessa 1991."
"*.* *.COM ..\*.COM"
It is unknown what TechnoRat may do besides replicate.