TPWorm Virus

Virus Name: TPWorm Aliases: V Status: Rare Discovery: December, 1992 Symptoms: .COM files created; message Origin: Unknown Eff Length: 12,969 Bytes Type Code: SNE - Spawning Non-Resident .EXE Infector Detection Method: AVTK, F-Prot, Sweep, ViruScan, IBMAV, NAV, NAVDX, VAlert, Sweep/N, AVTK/N, NShld, NProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The TPWorm virus was submitted in December, 1992. Its origin or point of isolation is unknown. TPWorm is a non-resident spawning or companion virus which infects .EXE programs. When a program infected with the TPWorm virus is executed, the TPWorm virus will infect three .EXE programs in the current directory by creating 12,969 byte .COM files with the same base file names. These companion .COM files will have the current system date and time when they were created. The virus may then display the message: "Find me!" The TPWorm virus does not always display this message. It will then delete the companion .COM file which the user had executed. As indicated above, the companion files created by this virus are 12,969 bytes in length. They are not hidden, and are visible within the disk directory listing. The following text strings can be found within the TPWorm companion files: ".com .exe" "PATH ; ; ; \ *.exe .com rb wb .EXE" "Find me!" "Packed file is corrupt" TPWorm doesn't appear to do anything besides display its message and infect files.