Turn.557 Virus
Virus Name: Turn.557
Aliases:
V Status: New
Discovered: July, 1994
Symptoms: .COM file growth; file date/time changes
Origin: Unknown
Eff Length: 557 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, Sweep, NAV,
NAVDX, VAlert, ChAV,
NProt, AVTK/N, Sweep/N, Innoc, IBMAV/N, NShld, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Turn.557 virus was submitted in July, 1994. Its origin or point
of isolation is unknown. Turn.557 is a memory resident infector of
.COM files, including COMMAND.COM.
The first time a program infected with the Turn.557 virus is
executed, the virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary, hooking interrupt 21.
Total system memory and available free memory, as indicated by the
DOS CHKDSK program, will have decreased by 1,632 bytes.
Once memory resident, the Turn.557 virus will infect .COM programs,
including COMMAND.COM, when they are executed. Infected programs will
have a file length increase of 557 bytes with the virus being located
at the beginning of the file. The program's date and time in the
DOS disk directory listing will have been updated to the current
system date and time when infection occurred. No text strings are
visible within the viral code.