Terminator-3549 Virus
Virus Name: Terminator-3549
Aliases:
V Status: Rare
Discovered: December, 1992
Symptoms: .EXE files corrupted; programs overwritten; programs fail to
function properly; "Divide overflow" message; file date/time
changes
Origin: The Netherlands
Eff Length: 3,549 Bytes
Type Code: ONE - Non-Resident Overwriting .EXE Infector
Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan, VAlert,
NAV, NAVDX, ChAV,
Sweep/N, NShld, AVTK/N, IBMAV/N, Innoc, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Terminator-3549 virus was submitted in December, 1992. It is
originally from The Netherlands. Terminator-3549 is a non-resident
direct action overwriting virus which infects .EXE programs. It
permanently damages the programs it infects.
When a program infected with the Terminator-3549 virus is executed,
the Terminator-3549 virus will infect one .EXE program located on
the C: drive. The virus starting infecting .EXE programs in the
C: drive's root directory, and will slowly work down the directory
structure.
Programs infected with the Terminator-3549 virus will have the
first 3,549 bytes of the host program overwritten by the viral
code. Unless the .EXE file was originally smaller than 3,549 bytes,
there will be no file length increase. Programs smaller than
3,549 bytes in size before infection will become 3,549 bytes in
length after infection. The program's date and time in the DOS disk
directory listing will have been updated to the current system date
and time when infection occurred. The following text strings are
visible within the viral code in Terminator-3549 infected programs:
"*.exe"
"$456789:;