Virus Name: Tornado
V Status: New
Discovery: January, 1996
Symptoms: .COM file growth
Eff Length: 461 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, NAV, NAVDX, ViruScan, ChAV,
AVTK/N, IBMAV/N, NAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Tornado or Tornado.461 virus was received in January, 1996. Its
origin or point of isolation is unknown. Tornado is a non-resident,
direct action infector of .COM files, including COMMAND.COM.
When a program infected with the Tornado virus is executed, this
virus will infect one or two .COM files located in the current
directory, though it will quit infecting files in the current
directory once it encounters a very small .COM file.
Programs infected with the Tornado virus will have a file length
increase of 461 bytes with the virus being located at the end of the
file. The program's date and time in the DOS disk directory listing
will not be altered. The following text string is visible within
the viral code:
"[ Red-Zar / TorNado ]"
Additionally, the text string "RZ" can be found starting in the
fourth byte of all infected files. The text string "*.COM" is
encrypted within the viral code, and is not visible within the
viral code in infected files.