TSoft Virus


 Virus Name:  TSoft 
 Aliases:     TSoft-547, TurboSoft, TurboSoft-547 
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .COM file growth; file time seconds set to "62"; 
              hard disk corruption 
 Origin:      Poland 
 Eff Length:  547 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, IBMAV, ViruScan, Sweep, AVTK, 
                    NAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The TSoft, or TurboSoft, virus was submitted in December, 1992.  It 
       is originally from Poland.  TSoft is a non-resident, direct action 
       infector of .COM programs, including COMMAND.COM.  It is based on 
       the Vienna virus. 
 
       When a program infected with the TSoft virus is executed, the TSoft 
       virus will infect one .COM program located in the current directory. 
       Infected programs will have a file length increase of 547 bytes 
       with the virus being located at the end of the file.  The program's 
       file date and time in the DOS disk directory listing will appear to 
       not be altered, though the seconds field in the file time will have 
       been set to "62".  The following text strings can be found within 
       the viral code in all TSoft infected programs: 
 
               "\????????.COM" 
               "????????COM" 
               "TurboSoftware" 
 
       TSoft contains code to overwrite a portion of the system hard disk. 
 
       Known variant(s) of TSoft are: 
       TSoft-598: A 598 byte variant of the TSoft virus, this variant 
                  infects one .COM program in the current directory each 
                  time an infected program is executed.  Infected programs 
                  will have a file length increase of 598 bytes.  The 
                  seconds field in the file time in the DOS disk directory 
                  will be set to "62".  The following text strings can be 
                  found within the viral code in all TSoft-598 infected 
                  programs: 
                  "\????????.COM" 
                  "????????COM" 
                  "\dos" 
                  "T.Software -Death 1.0" 
                  TSoft-598 contains code to overwrite a portion of the 
                  system hard disk. 
                  Origin:  Poland  December, 1992. 
 
       See:  Vienna 

Show viruses from discovered during that infect .

Main Page