Tester Virus

Virus Name: Tester Aliases: TestVir, TestVirus B V1.4 V Status: Rare Discovered: April, 1991 Symptoms: .COM growth; messages Origin: United States Eff Length: 1,000 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, IBMAV, PCScan, VAlert, NAVDX, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Tester, or TestVir, virus was received in April, 1991. Its origin is unknown. This virus is a non-resident infector of .COM files. It will infect COMMAND.COM. When a program infected with Tester is executed, the virus will display the following messages, requiring a response by the system user: "This is TESTVIRUS B V1.4 ! 1 = infect COM-files of this directory + run orig. prog. 5 = run only orig. program 9 = abort" If a "1" is entered by the system user, the virus will then infect all of the .COM programs in the current directory, and then execute the original program. When Tester infects .COM programs, it will display one of the following two lines, indicating which .COM program it is currently processing. The first line is displayed for the program if it was previously infected, the second line only if it is currently infecting the program: "Already infected: xxxxxxxx.COM" "INFECTED: ------> xxxxxxxx.COM" Entering a "5" will result in no additional programs being infected, and the original program is executed. Finally, entering a "9" will result in the program terminating and the user being returned to a DOS prompt. Programs infected with Tester will increase in size by 1,000 bytes, the virus will be located at the beginning of the infected file. The program's date and time in the DOS disk directory will have also been updated to the date and time when infection occurred.