Turbo Virus

 Virus Name:  Turbo 
 Aliases:     Turbo 448, @ Virus, Turbo @, Polish-2, Nagytud 
 V Status:    Rare 
 Discovered:  November, 1990 
 Symptoms:    .COM growth; "File not found" errors with some utilities 
 Origin:      Hungary 
 Eff Length:  448 Bytes 
 Type Code:   PRCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Turbo, or Turbo 448, virus was discovered in Hungary in 
       November, 1990. This virus is a memory resident infector of 
       .COM files, including COMMAND.COM. 
       The first time a program infected with the Turbo virus is 
       executed, the virus will install itself memory resident at the end 
       of the Command Interpreter in memory.  Total system memory and 
       available free memory will not decrease.  Interrupt 21 will be 
       hooked by the virus. 
       The Turbo virus is unusual in that it does not infect programs 
       when they are executed.  Instead, it infects .COM files when they 
       are opened for some other reason besides execution.  For example, 
       if the virus is memory resident a program A.COM is copied to B.COM, 
       both programs will become infected by the virus. 
       Infected files will increase in length by 448 bytes, with the 
       virus being located at the end of the file.  The program's date and 
       time in the disk directory will also have been updated to the 
       system date and time when the file was infected.  The following 
       text string can be found at the end of all infected programs: 
               "Udv minden nagytudasunak! Turbo @" 
       Another interesting behavior of this virus is that when the virus 
       is memory resident, anti-viral products which are unaware of the 
       Turbo 448's presence in memory will not function properly.  After 
       the third file is read, the program may fail due to a "file not 
       found" error being received when it attempts to open the fourth 
       Known variant(s) of Turbo are: 
       Turbo Kukac: Discovered in Hungary in November, 1990, this 
                    virus is a memory resident infector of .COM programs, 
                    including COMMAND.COM.  It installs itself memory 
                    resident following the command interpreter and any 
                    previously loaded TSRs, decreasing total system and 
                    available free memory by 1,040 bytes.  Interrupts 05 
                    and 21 are hooked by the virus.  Turbo Kukac infects 
                    .COM programs when they are opened for a reason other 
                    than execution.  Infected programs will increase in 
                    size by 512 bytes with the virus being located at the 
                    end of the infected file.  The program's date and 
                    time in the DOS disk directory listing will have been 
                    updated.  The following text string can be found 
                    in all infected programs: 
                    "Turbo Kukac 9.9" 
                    Origin:  Hungary  November, 1990. 

Show viruses from discovered during that infect .

Main Page