Virus Name: Thimble
V Status: Rare
Discovered: February, 1992
Symptoms: .COM file growth; TSR; file date/time change
Eff Length: 1,024 - 2,046 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, PCScan,
IBMAV, NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Thimble virus was submitted in February, 1992. Its origin, or
point of isolation, is unknown. Thimble is a memory resident
infector of .COM programs, including COMMAND.COM.
When the first Thimble infected .COM program is executed, the
Thimble virus will install itself memory resident as a low system
memory TSR of 4,416 bytes. Interrupts 21 and CC will be hooked by
the virus in memory.
After the Thimble virus has become memory resident, it will infect
.COM programs when they are executed. If COMMAND.COM is executed,
it will become infected.
Programs infected with the Thimble virus will normally increase
in size by 1,024 bytes. The exception is that programs which were
originally smaller than 1,024 bytes in length will become 2,048
bytes in length. The virus will be located at the beginning of the
program. The file's date and time in the DOS disk directory listing
will have been updated to the current system date and time when
The following text strings can be found in all Thimble infected
"Greetings to Cracker Jack..."
"Loving thoughts to Shirley"
"Marty McFly lives somewhere in time."
"Kill Eddie. Kill Diana. Kill Fredo."
It is unknown if Thimble does anything besides replicate.