Virus Name: Tester
Aliases: TestVir, TestVirus B V1.4
V Status: Rare
Discovered: April, 1991
Symptoms: .COM growth; messages
Origin: United States
Eff Length: 1,000 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, PCScan,
VAlert, NAVDX, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Tester, or TestVir, virus was received in April, 1991. Its
origin is unknown. This virus is a non-resident infector of .COM
files. It will infect COMMAND.COM.
When a program infected with Tester is executed, the virus will
display the following messages, requiring a response by the system
"This is TESTVIRUS B V1.4 !
1 = infect COM-files of this directory + run orig. prog.
5 = run only orig. program
9 = abort"
If a "1" is entered by the system user, the virus will then infect
all of the .COM programs in the current directory, and then execute
the original program. When Tester infects .COM programs, it will
display one of the following two lines, indicating which .COM
program it is currently processing. The first line is displayed for
the program if it was previously infected, the second line only if
it is currently infecting the program:
"Already infected: xxxxxxxx.COM"
"INFECTED: ------> xxxxxxxx.COM"
Entering a "5" will result in no additional programs being
infected, and the original program is executed. Finally, entering
a "9" will result in the program terminating and the user being
returned to a DOS prompt.
Programs infected with Tester will increase in size by 1,000 bytes,
the virus will be located at the beginning of the infected file.
The program's date and time in the DOS disk directory will have
also been updated to the date and time when infection occurred.