TPWorm Virus

 Virus Name:  TPWorm 
 V Status:    Rare 
 Discovery:   December, 1992 
 Symptoms:    .COM files created; message 
 Origin:      Unknown 
 Eff Length:  12,969 Bytes 
 Type Code:   SNE - Spawning Non-Resident .EXE Infector 
 Detection Method:  AVTK, F-Prot, Sweep, ViruScan, 
                    IBMAV, NAV, NAVDX, VAlert, 
                    Sweep/N, AVTK/N, NShld, NProt, IBMAV/N, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The TPWorm virus was submitted in December, 1992.  Its origin or 
       point of isolation is unknown.  TPWorm is a non-resident spawning 
       or companion virus which infects .EXE programs. 
       When a program infected with the TPWorm virus is executed, the 
       TPWorm virus will infect three .EXE programs in the current 
       directory by creating 12,969 byte .COM files with the same base 
       file names.  These companion .COM files will have the current system 
       date and time when they were created.  The virus may then display 
       the message: 
               "Find me!" 
       The TPWorm virus does not always display this message.  It will 
       then delete the companion .COM file which the user had executed. 
       As indicated above, the companion files created by this virus are 
       12,969 bytes in length.  They are not hidden, and are visible 
       within the disk directory listing.  The following text strings 
       can be found within the TPWorm companion files: 
               ".com .exe" 
               "PATH  ; ; ; \ *.exe .com  rb  wb  .EXE" 
               "Find me!" 
               "Packed file is corrupt" 
       TPWorm doesn't appear to do anything besides display its message 
       and infect files. 

Show viruses from discovered during that infect .

Main Page