Terminator-3549 Virus


 Virus Name:  Terminator-3549 
 Aliases:    
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .EXE files corrupted; programs overwritten; programs fail to 
              function properly; "Divide overflow" message; file date/time 
              changes 
 Origin:      The Netherlands 
 Eff Length:  3,549 Bytes 
 Type Code:   ONE - Non-Resident Overwriting .EXE Infector 
 Detection Method:  AVTK, IBMAV, Sweep, F-Prot, ViruScan, VAlert, 
                    NAV, NAVDX, ChAV, 
                    Sweep/N, NShld, AVTK/N, IBMAV/N, Innoc, NAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Terminator-3549 virus was submitted in December, 1992.  It is 
       originally from The Netherlands.  Terminator-3549 is a non-resident 
       direct action overwriting virus which infects .EXE programs.  It 
       permanently damages the programs it infects. 
 
       When a program infected with the Terminator-3549 virus is executed, 
       the Terminator-3549 virus will infect one .EXE program located on 
       the C: drive.  The virus starting infecting .EXE programs in the 
       C: drive's root directory, and will slowly work down the directory 
       structure. 
 
       Programs infected with the Terminator-3549 virus will have the 
       first 3,549 bytes of the host program overwritten by the viral 
       code.  Unless the .EXE file was originally smaller than 3,549 bytes, 
       there will be no file length increase.  Programs smaller than 
       3,549 bytes in size before infection will become 3,549 bytes in 
       length after infection.  The program's date and time in the DOS disk 
       directory listing will have been updated to the current system date 
       and time when infection occurred.  The following text strings are 
       visible within the viral code in Terminator-3549 infected programs: 
 
               "*.exe" 
               "$456789:;=>?u" 
 
       Execution of infected programs may result in the following message 
       being displayed on the system monitor: 
 
               "Divide overflow" 

Show viruses from discovered during that infect .

Main Page