Virus Name: TPWorm
V Status: Rare
Discovery: December, 1992
Symptoms: .COM files created; message
Eff Length: 12,969 Bytes
Type Code: SNE - Spawning Non-Resident .EXE Infector
Detection Method: AVTK, F-Prot, Sweep, ViruScan,
IBMAV, NAV, NAVDX, VAlert,
Sweep/N, AVTK/N, NShld, NProt, IBMAV/N, NAV/N
Removal Instructions: Delete infected files
The TPWorm virus was submitted in December, 1992. Its origin or
point of isolation is unknown. TPWorm is a non-resident spawning
or companion virus which infects .EXE programs.
When a program infected with the TPWorm virus is executed, the
TPWorm virus will infect three .EXE programs in the current
directory by creating 12,969 byte .COM files with the same base
file names. These companion .COM files will have the current system
date and time when they were created. The virus may then display
The TPWorm virus does not always display this message. It will
then delete the companion .COM file which the user had executed.
As indicated above, the companion files created by this virus are
12,969 bytes in length. They are not hidden, and are visible
within the disk directory listing. The following text strings
can be found within the TPWorm companion files:
"PATH ; ; ; \ *.exe .com rb wb .EXE"
"Packed file is corrupt"
TPWorm doesn't appear to do anything besides display its message
and infect files.