Virus Name: Timemark
Aliases: Timemark 1
V Status: Rare
Discovery: August, 1992
Symptoms: .EXE file growth; decrease in total system & available free
Eff Length: 1,062 - 1,076 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: Sweep, ViruScan, AVTK, IBMAV, F-Prot, PCScan,
NAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N,
Removal Instructions: Delete infected files
The Timemark virus was submitted in August, 1992. It is originally
from Poland. Timemark is a memory resident infector of .EXE
When the first Timemark program is executed, the Timemark virus will
install itself memory resident at the top of system memory but below
the 640K DOS boundary. Total system and available free memory, as
indicated by the DOS CHKDSK program, will have decreased by 1,072
bytes. Interrupts 1C and 21 will be hooked by the Timemark virus.
Once the Timemark virus is memory resident, it will infect .EXE
programs (other than very small ones) when they are executed.
Infected .EXE programs will have a file length increase of 1,062 to
1,076 bytes with the virus being at the end of the file. The
program's date and time in the DOS disk directory listing will not
be altered. No text strings are visible within the Timemark viral
It is unknown what Timemark does besides replicate.
Known variant(s) of Timemark are:
Timemark 2: Probably an earlier version of the Timemark virus,
this variant's size in memory is 1,088 bytes, hooking
interrupts 1C and 21. It adds 1,083 to 1,097 bytes
to the .EXE files it infects. Unlike Timemark,
Timemark 2 will reinfect previously infected programs,
adding an additional 1,083 to 1,097 bytes. The file's
date and time in the DOS disk directory listing will
not be altered.
Origin: Poland August, 1992.