Virus Name: Twin-351
Aliases: COM 351, Twin
V Status: Rare
Discovered: July, 1991
Symptoms: .COM files created with system & hidden attributes; TSR
Eff Length: 351 Bytes
Type Code: SRsA - Spawning Resident .COM/.EXE Infector
Detection Method: ViruScan, Sweep, AVTK, NAV, F-Prot, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete hidden infected files
The Twin-351 virus was isolated in Europe in July, 1991. Twin-351
is a memory resident spawning virus. It infects .EXE files by
creating a corresponding .COM file which DOS will execute in place
of the .EXE program.
The first time a program infected with Twin-351 is executed, Twin-351
will install itself memory resident as a low system memory TSR of
656 bytes. Interrupt 21 will be hooked by the virus.
Once memory resident, Twin-351 will infect .EXE files when they are
executed. Instead of altering the .EXE file, Twin-351 creates a
351 byte .COM file with a file name which corresponds to the file
name of the .EXE file. For example, if the user was attempting to
execute ABC.EXE, Twin-351 will create ABC.COM which contains its
viral code. The 351 byte .COM files created by the virus will have
the hidden and system attributes set so that the files are not
visible in the disk directory listing.
As a result of the hidden .COM files, when the user attempts to
execute a .EXE file, the Twin-351 .COM file will be executed first.
If Twin-351 is already memory resident, it will then execute the
corresponding .EXE file. If Twin-351 wasn't already resident, it
will become resident.
Twin-351 will hide the hidden files if the user attempts to execute
an anti-viral program with Twin-351 in memory.