Tigre Virus

Virus Name: Tigre Aliases: Tigre.1800, Tigre.1800.A V Status: New Discovery: July, 1995 Symptoms: .COM & .EXE growth; file date/time seconds = "58"; decrease in available free memory Origin: Argentina Eff Length: 1,800 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, IBMAV, PCScan, VAlert, AVTK, NAV, NAVDX, F-Prot, ChAV, IBMAV/N, NShld, AVTK/N, NAV/N, NProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Tigre or Tigre.1800.A virus was received in July, 1995. Its is probably from Argentina. Tigre is a memory resident stealth type virus which infects .COM and .EXE files, including COMMAND.COM. When the first Tigre infected program is executed, this virus will become memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 3,840 bytes. Interrupts 09 and 21 will be hooked by the virus in memory. Once the Tigre virus is memory resident, it will infect .COM and some .EXE files when they are executed or opened, but not on copy. Infected programs will have a file length increase of 1,800 bytes, though this file length increase will be hidden when the virus is memory resident. The viral code will be located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "58". The following text strings are encrypted within the viral code: "C:CHKLIST.MS C:CHKLIST.CPS C:ZZ##.IM anti-vir.dat ANTI-VIR.DAT" "Digital Anarchy" "Virus TIGRE v2.0 - (c) 1995" "Escrito por EL CANCERBERO [DAN]" "22/02/95 - Republica Argentina" This virus may interfer with the functionality of Central Point Anti-Virus and Microsoft Anti-Virus. It is unknown what it may do besides replicate. Known variant(s) of Tigre are: Tigre.1800.B: Received in January, 1996, this is an earlier variant of the Tigre virus described above. It does not hide the file length increase of infected .EXE files. The following text strings are encrypted within the viral code: "C:CHKLIST.MS C:CHKLIST.CPS C:ZZ##.IM anti-vir.dat ANTI-VIR.DAT" "DIGITAL ANARCHY" "Virus TIGRE v1.0 - (c) 1995" "Escrito por El Cancerbero [DAN]" "17/02/95 - Argentina" Origin: Argentina January, 1996.