Online VSUM - Tiny Virus Virus

Tiny Virus Virus

Virus Name: Tiny Virus Aliases: Danish Tiny, 163 COM Virus, Tiny 163 Virus V Status: Rare Discovery: June, 1990 Symptoms: COMMAND.COM & .COM file growth Origin: Denmark Eff Length: 163 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, or delete infected files General Comments: The 163 COM Virus, or Tiny Virus, was isolated by Fridrik Skulason of Iceland in June 1990. This virus is a non-resident generic .COM file infector, and it will infect COMMAND.COM. The first time a file infected with the 163 COM Virus is executed, the virus will attempt to infect the first .COM file in the current directory. On bootable diskettes, this file will normally be COMMAND.COM. After the first .COM file is infected, each time an infected program is executed another .COM file will attempt to be infected. Files are infected only if their original length is greater than approximately 1K bytes. Infected .COM files will increase in length by 163 bytes, and have date/time stamps in the directory changed to the date/time the infection occurred. Infected files will also always end with this hex string: '2A2E434F4D00'. This virus currently does nothing but replicate, and is the smallest MS-DOS virus known as of its isolation date. The Tiny Virus may or may not be related to the Tiny Family documented elsewhere in this listing. Known variant(s) of the Tiny Virus are: 191: A 191 byte variant of the Tiny Virus, the 191 virus will infect one .COM file in the current directory each time an infected program is executed. Infected programs will have a file length increase of 191 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. One text string occurs in the viral code: "*.COM" The 191 virus does not infect very small files, and it will usually not infect more than four files in the current directory. It does nothing besides replicate. Origin: Unknown December, 1991. Brenda: A 256 byte variant of the Tiny Virus, Brenda infects one .COM file in the current directory when an infected program is executed. Infected programs will have a file length increase of 256 bytes with the virus being located at the end of the infected file. The program's date and time in the DOS disk directory listing will be updated to the current system date and time when infection occurred. After Brenda has infected the first three .COM files in the current directory, it will display the following message instead of infecting a file when an infected program is executed: "(C) '92, Stingray/VIPER Luv, Brenda" This message is not visible in infected files as it is encrypted. One text string is visible within the Brenda virus viral code: "*.COM". Origin: Unknown May, 1992. Brenda-B: Functionally similar to Brenda, this variant has one byte which has been altered. Origin: Unknown October, 1992. Danish Tiny.476: A 476 byte variant of the Tiny Virus, this virus will infect one .COM file in the current directory each time an infected program is executed. Infected programs will have a file length increase of 476 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. The following text is encrypted within the viral code: "*.COM .." "EW_476 MM2 VIRUS\MYVIRII\TEMP ge by the BLACK WIND VIRUS..." "Copyright (C) 1992, Destructive Technologies, Unlimited." Origin: Unknown July, 1994. Danish Tiny.NC.284: A 284 byte variant of the Tiny Virus, this virus will infect the first .COM file in the current directory each time an infected program is executed. Infected programs will have a file length increase of 284 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. The following text is visible within the viral code: "*.*" "***NIGHTCRAWLER V 2.0 ***" "Written by the Weasel! (C) Sector Infector Inc" This variant will reinfect previously infected files, adding an additional 284 bytes with each reinfection. Origin: Unknown July, 1994. Kennedy: The Kennedy virus is a 333 byte variant of the Tiny virus. It infects one .COM program when an infected program is executed, adding 333 bytes to the end of the file. This virus has three activation dates: June 6 (Robert Kennedy's assassination in 1968), November 18 (death of Joseph Kennedy in 1969), and November 22 (John F. Kennedy's assassination in 1963) of any year. On activation, the virus will display the following message: "Kennedy is deal - long live 'The Dead Kennedys'" Two text strings can be found within the viral code: "\command.com" "The Dead Kennedys" Infected systems will experience cross-linking of files, lost clusters, and file allocation table errors. Origin: Denmark April, 1990. Stigmata: Stigmata is a 1,000 byte variant of the Tiny Virus. It infects one .COM program in the current directory each time an infected program is executed, though it will stop infecting programs if it encounters a very small .COM file. Programs infected with the Stigmata virus will have a file length increase of 1,000 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code. Origin: Unknown January, 1992. Tiny-177: A 177 byte variant of the Tiny Virus, the Tiny-177 virus will infect one .COM file in the current directory each time an infected program is executed. Infected programs will have a file length increase of 177 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will be changed to the current system date and time when infection occurred. One text string is visible within the viral code: "*.COM" Origin: Unknown August, 1993. Tiny-180: A 180 byte variant of the Tiny Virus, the Tiny-180 virus will infect one .COM file in the current directory each time an infected program is executed. Infected programs will have a file length increase of 180 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. One text string occurs in the viral code: "*.COM" The Tiny-180 virus does not infect very small files, and it will usually not infect more than four files in the current directory. It does nothing besides replicate. Origin: Unknown June, 1993. See: Tiny Family