Tiny Di Virus
Virus Name: Tiny Di
Aliases: Tiny Di-94, Tiny Di-101, Tiny Di-108, Tiny Di-110, Di-94,
Di-101, Di-108, Di-110
V Status: Rare
Discovery: January, 1992
Symptoms: .COM file growth; file date/time change; boot failure;
Eff Length: 94 - 110 Bytes (see below)
Type Code: PNCK - Parasitic Non-resident .COM Infector
Detection Method: Sweep, ViruScan, F-Prot, AVTK, IBMAV, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Tiny Di, or Di, family of four viruses was received in January,
1992. Its origin is unknown. The viruses in this family are non-
resident infectors of .COM programs including COMMAND.COM. Since
these four viruses exhibit similar behavior, they will be described
in general, with their differences indicated below under variants.
When a program infected with a Tiny Di virus is executed, the virus
will infect all .COM files located in the current directory. If
COMMAND.COM is located in this directory, it will be infected as
well. Programs infected with one of the Tiny Di viruses will have
the virus located at the beginning of the infected file. The file
length increase, and whether the file will later be reinfected,
depends on which virus is present. In any case, the infected files
will have had their file date and time in the DOS disk directory
listing updated to the current system date and time when infection
One text string can be found within the viral code within Tiny Di
The Tiny Di viruses do not intentionally do anything besides
replicate, although programs may fail to execute properly once they
are infected. The system will also fail to boot if the boot drive's
copy of COMMAND.COM becomes infected.
Known members of the Tiny Di family are:
Tiny Di-94: This virus adds 94 bytes to the .COM files it
infects. It is unable to distinquish when a program
has been previously infected, so it will reinfect
previously infected .COM files. Each reinfection will
also add 94 bytes.
Tiny Di-101: A 101 byte member of the Tiny Di family, this virus
infects all .COM files in the current directory, though
not always in a parasitic manner. In some cases, the
virus will overwrite the first 101 bytes of infected
programs without saving the original first 101 bytes.
Therefore, with the initial infection of a program, the
file length increase will be either zero or 101 bytes.
Like Tiny Di-94, it cannot recognize previously infected
files, and will later reinfect them, adding an additional
zero or 101 bytes.
Tiny Di-108: Similar to Tiny Di-101, this virus is 108 bytes in
length and will infect some programs in a parasitic
manner, and others by overwriting the first 108 bytes.
Unlike Tiny Di-101, it can recognize previously infected
files, and does not reinfect them.
Tiny Di-110: Similar to Tiny Di-108, this virus is 110 bytes in