Timemark Virus

 Virus Name:  Timemark 
 Aliases:     Timemark 1 
 V Status:    Rare 
 Discovery:   August, 1992 
 Symptoms:    .EXE file growth; decrease in total system & available free 
 Origin:      Poland 
 Eff Length:  1,062 - 1,076 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  Sweep, ViruScan, AVTK, IBMAV, F-Prot, PCScan, 
                    NAV, NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Timemark virus was submitted in August, 1992.  It is originally 
       from Poland.  Timemark is a memory resident infector of .EXE 
       When the first Timemark program is executed, the Timemark virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary.  Total system and available free memory, as 
       indicated by the DOS CHKDSK program, will have decreased by 1,072 
       bytes.  Interrupts 1C and 21 will be hooked by the Timemark virus. 
       Once the Timemark virus is memory resident, it will infect .EXE 
       programs (other than very small ones) when they are executed. 
       Infected .EXE programs will have a file length increase of 1,062 to 
       1,076 bytes with the virus being at the end of the file.  The 
       program's date and time in the DOS disk directory listing will not 
       be altered.  No text strings are visible within the Timemark viral 
       It is unknown what Timemark does besides replicate. 
       Known variant(s) of Timemark are: 
       Timemark 2: Probably an earlier version of the Timemark virus, 
                   this variant's size in memory is 1,088 bytes, hooking 
                   interrupts 1C and 21.  It adds 1,083 to 1,097 bytes 
                   to the .EXE files it infects.  Unlike Timemark, 
                   Timemark 2 will reinfect previously infected programs, 
                   adding an additional 1,083 to 1,097 bytes.  The file's 
                   date and time in the DOS disk directory listing will 
                   not be altered. 
                   Origin:  Poland  August, 1992. 

Show viruses from discovered during that infect .

Main Page