Today Virus

Virus Name: Today Aliases: V Status: Viron Discovery: June, 1993 Symptoms: .COM file corruption; program execution failure; boot failure; file date/time changes Origin: Unknown Eff Length: 177 Bytes Overwriting Type Code: ONCK - Overwriting Non-Resident .COM Infector Detection Method: F-Prot, ViruScan, Sweep, IBMAV, AVTK, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Today virus was submitted in June, 1993. Its origin or point of isolation is unknown. Today is a non-resident, overwriting virus which infects .COM programs, including COMMAND.COM. It permanently corrupts the programs it infects. When a program infected with the Today virus is executed, the Today virus will infect one .COM program located in the current directory. The Today virus overwrites the first 177 bytes of the host file, so unless the program was originally smaller than 177 bytes, the file's length will not be altered. Programs which were originally smaller than 177 bytes will become 177 bytes when infected by Today. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string is visible within the viral code in all Today infected programs: "*.COM Today is Good Thursday, nothing can go wrong!"