Thimble Virus

Virus Name: Thimble Aliases: V Status: Rare Discovered: February, 1992 Symptoms: .COM file growth; TSR; file date/time change Origin: Unknown Eff Length: 1,024 - 2,046 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, PCScan, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Thimble virus was submitted in February, 1992. Its origin, or point of isolation, is unknown. Thimble is a memory resident infector of .COM programs, including COMMAND.COM. When the first Thimble infected .COM program is executed, the Thimble virus will install itself memory resident as a low system memory TSR of 4,416 bytes. Interrupts 21 and CC will be hooked by the virus in memory. After the Thimble virus has become memory resident, it will infect .COM programs when they are executed. If COMMAND.COM is executed, it will become infected. Programs infected with the Thimble virus will normally increase in size by 1,024 bytes. The exception is that programs which were originally smaller than 1,024 bytes in length will become 2,048 bytes in length. The virus will be located at the beginning of the program. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings can be found in all Thimble infected programs: "Greetings to Cracker Jack..." "Loving thoughts to Shirley" "Marty McFly lives somewhere in time." "Kill Eddie. Kill Diana. Kill Fredo." It is unknown if Thimble does anything besides replicate.