Virus Name: Tony
V Status: Rare
Discovery: November, 1991
Symptoms: .COM file growth
Eff Length: 200 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Tony virus was submitted in November, 1991. It comes to us from
Bulgaria. Tony is a non-resident, direct action infector of .COM
files, including COMMAND.COM.
When a program infected with the Tony virus is executed, the virus
will check the day of the system date. Depending on the day of the
month, the virus will determine which .COM files in the current
directory it will infect. The algorithm is if the day = "1", then
files starting with "B" are infected. On the 2nd, files starting
with "C" are infected. This algorithm continues for the rest of the
days of the month. Tony infects all .COM files in the current
directory which meet the selection criteria.
Tony infected programs will have a file length increase of 200
bytes. The virus will be located at the beginning of the infected
file. There will be no change in the file's date and time in a
DOS directory listing. The following text string can be found
within the viral code in Tony infected programs:
Tony does not do anything besides replicate.
Known variant(s) of Tony are:
Tony-203: Functionally similar to the Tony virus described
above, this variant adds 203 bytes to the .COM programs
it infects. The text string found in the original virus
also occurs in this variant.
Origin: Unknown December, 1992.