Virus Name: TSoft
Aliases: TSoft-547, TurboSoft, TurboSoft-547
V Status: Rare
Discovered: December, 1992
Symptoms: .COM file growth; file time seconds set to "62";
hard disk corruption
Eff Length: 547 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, IBMAV, ViruScan, Sweep, AVTK,
NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N
Removal Instructions: Delete infected files
The TSoft, or TurboSoft, virus was submitted in December, 1992. It
is originally from Poland. TSoft is a non-resident, direct action
infector of .COM programs, including COMMAND.COM. It is based on
the Vienna virus.
When a program infected with the TSoft virus is executed, the TSoft
virus will infect one .COM program located in the current directory.
Infected programs will have a file length increase of 547 bytes
with the virus being located at the end of the file. The program's
file date and time in the DOS disk directory listing will appear to
not be altered, though the seconds field in the file time will have
been set to "62". The following text strings can be found within
the viral code in all TSoft infected programs:
TSoft contains code to overwrite a portion of the system hard disk.
Known variant(s) of TSoft are:
TSoft-598: A 598 byte variant of the TSoft virus, this variant
infects one .COM program in the current directory each
time an infected program is executed. Infected programs
will have a file length increase of 598 bytes. The
seconds field in the file time in the DOS disk directory
will be set to "62". The following text strings can be
found within the viral code in all TSoft-598 infected
"T.Software -Death 1.0"
TSoft-598 contains code to overwrite a portion of the
system hard disk.
Origin: Poland December, 1992.