Tornado Virus

Virus Name: Tornado Aliases: Tornado.461 V Status: New Discovery: January, 1996 Symptoms: .COM file growth Origin: Unknown Eff Length: 461 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, IBMAV, NAV, NAVDX, ViruScan, ChAV, AVTK/N, IBMAV/N, NAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Tornado or Tornado.461 virus was received in January, 1996. Its origin or point of isolation is unknown. Tornado is a non-resident, direct action infector of .COM files, including COMMAND.COM. When a program infected with the Tornado virus is executed, this virus will infect one or two .COM files located in the current directory, though it will quit infecting files in the current directory once it encounters a very small .COM file. Programs infected with the Tornado virus will have a file length increase of 461 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code: "[ Red-Zar / TorNado ]" Additionally, the text string "RZ" can be found starting in the fourth byte of all infected files. The text string "*.COM" is encrypted within the viral code, and is not visible within the viral code in infected files.