Timemark Virus

Virus Name: Timemark Aliases: Timemark 1 V Status: Rare Discovery: August, 1992 Symptoms: .EXE file growth; decrease in total system & available free memory Origin: Poland Eff Length: 1,062 - 1,076 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: Sweep, ViruScan, AVTK, IBMAV, F-Prot, PCScan, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Timemark virus was submitted in August, 1992. It is originally from Poland. Timemark is a memory resident infector of .EXE programs. When the first Timemark program is executed, the Timemark virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,072 bytes. Interrupts 1C and 21 will be hooked by the Timemark virus. Once the Timemark virus is memory resident, it will infect .EXE programs (other than very small ones) when they are executed. Infected .EXE programs will have a file length increase of 1,062 to 1,076 bytes with the virus being at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the Timemark viral code. It is unknown what Timemark does besides replicate. Known variant(s) of Timemark are: Timemark 2: Probably an earlier version of the Timemark virus, this variant's size in memory is 1,088 bytes, hooking interrupts 1C and 21. It adds 1,083 to 1,097 bytes to the .EXE files it infects. Unlike Timemark, Timemark 2 will reinfect previously infected programs, adding an additional 1,083 to 1,097 bytes. The file's date and time in the DOS disk directory listing will not be altered. Origin: Poland August, 1992.