Traveller Virus
Virus Name: Traveller
Aliases: Bupt
V Status: Rare
Discovered: November, 1991
Symptoms: .COM & .EXE growth; decrease in total system and available
free memory
Origin: United States
Eff Length: 1,220 - 1,237 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, F-Prot, IBMAV, ChAV,
AVTK, NAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, NProt, AVTK/N, IBMAV/N,
NAV/N, Innoc
Removal Instructions: Delete infected files
General Comments:
The Traveller virus was received in November, 1991. It is reported
to have originated in the United States. Traveller is a memory
resident generic file infector of .COM and .EXE programs, including
COMMAND.COM.
The first time a program infected with Traveller is executed, the
Traveller virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary. Total system and
available free memory, as measured by the DOS CHKDSK program, will
have decreased by 1,840 bytes. Interrupt 21 will be hooked by
the virus in high system memory, as well as interrupt 24 in low
system memory. Interrupt 12's return will not have been moved.
Once Traveller is memory resident, it will infect .COM and .EXE
programs when they are executed. It will also infect one program
each time a previously infected program is executed, or whenever
a DOS DIR command is issued.
Programs infected with Traveller will have a file length increase
of 1,220 to 1,237 bytes, with the virus being located at the end
of the infected file. There will be no change to the file's date
and time in a DOS disk directory listing. Programs infected with
Traveller will contain the following text strings:
"Traveller (C) BUPT 1991.4"
"Don't panic I'm harmless <<---!!!!!!!"
"*.* COMEXE"
It is unknown if Traveller does anything besides replicate.
Known variant(s) of Traveller are:
Traveller-B: Also known as BUPT-B, this variant's size in
memory is 1,840 bytes, hooking interrupt 21. It
infects .COM and .EXE programs when they are executed
or one program each time a DOS DIR command is performed.
Infected .COM programs will have a file length increase
of 1,220 bytes. .EXE programs will increase in size by
1,223 to 1,238 bytes. In both cases, the virus will be
located at the end of the file. The program's date and
time in the DOS disk directory listing will not be
altered. The following text strings can be found within
all Traveller-B infected programs:
"*.* COMEXE"
"!!!!!!!--->> Traveller (C) BUPT 1991.4 Don't p"
Origin: Unknown December, 1992.
Traveller-C: Received in November, 1993, this variant's size in
memory is 2,032 bytes, hooking interrupt 21. It
infects .COM and .EXE programs when they are executed
or one program each time a DOS DIR command is performed.
Infected .COM programs will have a file length increase
of 1,261 bytes. .EXE programs will increase in size by
1,261 to 1,278 bytes. In both cases, the virus will be
located at the end of the file. The program's date and
time in the DOS disk directory listing will not be
altered. The following text strings can be found within
all Traveller-C infected programs:
"*.* COM EXE"
"!!!!!!!--->> Traveller (C) BUPT IE 1991.4 Don't
panic,I'm harmless!!!!!!!<<---"
Origin: Unknown November, 1993.
Traveller-C2: Received in November, 1993, this is a very minor
variant of Traveller-C, and is functionally similar.
Origin: Unknown November, 1993.
Traveller-C3: Received in November, 1993, this is a very minor
variant of Traveller-C, and is functionally similar.
Origin: Unknown November, 1993.